Account Takeover in bookwyrm-social/bookwyrm

Valid

Reported on

Jul 12th 2022


  1. Hello team, while i was testing on https://book.dansmonorage.blue/login i noticed that there is no ratelimit protection on POST login form, so an attacker can takeover the account by brute forcing the password field

Steps to reproduce:

  1. go to https://book.dansmonorage.blue/login
  2. Enter username and any password
  3. Capture the request with burpsuite and start bruteforcing with our wordlist

POC Screenshot:

Patch recommendation:

  1. Add ratelimit protecion on POST login endpoints/parameters

Impact

  1. Account takeover
We are processing your report and will contact the bookwyrm-social/bookwyrm team within 24 hours. 22 days ago
We have contacted a member of the bookwyrm-social/bookwyrm team and are waiting to hear back 21 days ago
We have sent a follow up to the bookwyrm-social/bookwyrm team. We will try again in 7 days. 18 days ago
Akshay Ravi
14 days ago

Researcher


Hello @maintainer any update on this?

We have sent a second follow up to the bookwyrm-social/bookwyrm team. We will try again in 10 days. 11 days ago
Mouse Reeve validated this vulnerability 6 days ago
Akshay Ravi has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Mouse Reeve confirmed that a fix has been merged on 7bbe42 6 days ago
The fix bounty has been dropped
Akshay Ravi
6 days ago

Researcher


@maintainer are you happy to assign a CVE? please confirm, then only admin can move further

Akshay Ravi
5 days ago

Researcher


@Mouse Revee @maintainer please confirm are you happy to assign a CVE?😇

Akshay Ravi
4 days ago

Researcher


@admin can you pls assign a CVE for this?

Jamie Slome
2 days ago

Admin


We will wait for the maintainer to approve a CVE for this report and then proceed with one 👍

Mouse Reeve
19 hours ago

Maintainer


Sorry for the delay, I didn't get a notification about these comments. I've created a CVE for this and added Akshay as a collaborator.

Jamie Slome
18 hours ago

Admin


Great 👍

Akshay Ravi
6 hours ago

Researcher


@admin CVE-2022-35925 has assigned for this issue, can you please add this CVE on this report(CVE ID)

https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-jvp3-mqv8-5rjw

Jamie Slome
an hour ago

Admin


CVE is attached to the report 👍

Jamie Slome
an hour ago

Admin


@mouse - would you like me to assign a CVE to the other report or are you happy to do this via GitHub?

to join this conversation