Account Takeover in bookwyrm-social/bookwyrm
Reported on
Jul 12th 2022
- Hello team, while i was testing on
https://book.dansmonorage.blue/logini noticed that there is no ratelimit protection on POST login form, so an attacker can takeover the account by brute forcing the password field
Steps to reproduce:
- go to
https://book.dansmonorage.blue/login - Enter username and any password
- Capture the request with burpsuite and start bruteforcing with our wordlist
POC Screenshot:
Patch recommendation:
- Add ratelimit protecion on POST login endpoints/parameters
Impact
- Account takeover
@maintainer are you happy to assign a CVE? please confirm, then only admin can move further
@Mouse Revee @maintainer please confirm are you happy to assign a CVE?😇
We will wait for the maintainer to approve a CVE for this report and then proceed with one 👍
Sorry for the delay, I didn't get a notification about these comments. I've created a CVE for this and added Akshay as a collaborator.
@admin CVE-2022-35925 has assigned for this issue, can you please add this CVE on this report(CVE ID)
https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-jvp3-mqv8-5rjw
@mouse - would you like me to assign a CVE to the other report or are you happy to do this via GitHub?
@jamieslome I'd be happy for you to do that. If it's preferable for me to do it in GitHub I can do that instead, just let me know, but otherwise I'll assume it's handled.
@mouse-reeve - CVE is all sorted on the other report 👍 It should be published shortly - nothing to do on your end :)