Description

The login page doesn't have any protection against a brute-force password attack, which allows an attacker to try every possible combination without any restriction.

Proof of Concept

1. 1 - Send a login request of the target user

POST /api/auth/token HTTP/1.1
Host: localhost:9091
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLDx5Wjaf8w8QGFao

------WebKitFormBoundaryLDx5Wjaf8w8QGFao
Content-Disposition: form-data; name="username"

admin@email.com
------WebKitFormBoundaryLDx5Wjaf8w8QGFao
Content-Disposition: form-data; name="password"

password
------WebKitFormBoundaryLDx5Wjaf8w8QGFao
Content-Disposition: form-data; name="remember_me"

false
------WebKitFormBoundaryLDx5Wjaf8w8QGFao--

2. 2 - Capture and replay the login request with a different password everytime

Impact

An attacker could perform a brute-force attack targeting normal and administrative users, using different passwords and eventually gain access to the targeted account, without any restriction.