Rucio WebUI has Username Enumeration via Login Error Message

The vulnerability exists in the Rucio WebUI login endpoint /ui/login, which responds with different error messages depending on whether the submitted username exists in the system. When a non-existent username is provided, the error message states "Cannot get find any account associated with identity." In contrast, an existing username with an incorrect password yields a different error: "Cannot get auth token. It is possible that the presented identity is not mapped to any Rucio account." This behavioral difference directly enables username enumeration [3].

An unauthenticated attacker can exploit this by sending a series of login requests with various usernames and analyzing the error responses. No authentication or special network access is required; the WebUI is typically exposed to the internet. The attacker can systematically determine which usernames are valid, building a list of legitimate accounts [3].

The impact of this vulnerability is that an attacker can compile a list of valid usernames, which can then be used for targeted attacks such as password guessing, credential stuffing, or social engineering campaigns. The enumeration lowers the barrier for further exploitation by reducing the search space for usernames [3].

The issue is fixed in Rucio versions 35.8.3, 38.5.4, and 39.3.1 by returning a generic authentication failure message for all login errors, regardless of username existence. This remediation aligns with the OWASP Authentication Cheat Sheet guidance to avoid disclosing account existence through error messages [1]. Users should upgrade to a patched version or apply the provided mitigation if upgrading is not immediately possible [3].