Account Takeover in bookwyrm-social/bookwyrm
Jul 12th 2022
- Hello team, while i was testing on
https://book.dansmonorage.blue/logini noticed that there is no ratelimit protection on POST login form, so an attacker can takeover the account by brute forcing the password field
Steps to reproduce:
- go to
- Enter username and any password
- Capture the request with burpsuite and start bruteforcing with our wordlist
- Add ratelimit protecion on POST login endpoints/parameters
- Account takeover
Hello @maintainer any update on this?
@maintainer are you happy to assign a CVE? please confirm, then only admin can move further
@Mouse Revee @maintainer please confirm are you happy to assign a CVE?😇
@admin can you pls assign a CVE for this?
We will wait for the maintainer to approve a CVE for this report and then proceed with one 👍
Sorry for the delay, I didn't get a notification about these comments. I've created a CVE for this and added Akshay as a collaborator.
CVE-2022-35925 has assigned for this issue, can you please add this CVE on this report(CVE ID)
CVE is attached to the report 👍
@mouse - would you like me to assign a CVE to the other report or are you happy to do this via GitHub?
@jamieslome I'd be happy for you to do that. If it's preferable for me to do it in GitHub I can do that instead, just let me know, but otherwise I'll assume it's handled.
@mouse-reeve - CVE is all sorted on the other report 👍 It should be published shortly - nothing to do on your end :)