Account Takeover [namelessmc.com] in namelessmc/nameless
Valid
Reported on
Aug 6th 2022
Description:
- Hello team, while i was testing on
https://namelessmc.com/login/i noticed that there is no ratelimit protection on POST login form, so an attacker can takeover the account by brute forcing the password field
Steps to reproduce:
- 1- go to
https://namelessmc.com/login/ - 2- Enter username and any password
- 3- Capture the request with burpsuite and start bruteforcing with our wordlist
POC Screenshot:
Patch recommendation:
- Add ratelimit protecion on POST login endpoints/parameters
Impact
- Account takeover
Occurrences
We are processing your report and will contact the
namelessmc/nameless
team within 24 hours.
a year ago
We have contacted a member of the
namelessmc/nameless
team and are waiting to hear back
a year ago
The researcher's credibility has increased: +7
@maintainer are you happy to assign a CVE? please confirm, then only admin can move further
@Sam waiting for bounty . This is critical vulnerability.
Happy to assign a CVE once we get the go-ahead from the maintainer 👍
@maintainer are you happy to assign a CVE ? Please confirm
We have sent a
fix follow up to the
namelessmc/nameless
team.
We will try again in 7 days.
a year ago
@maintainer are you happy to assign a CVE ? Please confirm
Hi, apologies for the delay.
Yes I am happy to go ahead with assigning a CVE.
login.php#L1-L331
has been validated
@admin maintainer as given the permission for assigning CVE. So please assign a CVE for this report
@admin waiting for bounty . This is critical vulnerability.
There is no bounty for this report. You should see the potential bounty for a report when you submit it.
to join this conversation