search

polonel / trudesk

:coffee: :seedling: Trudesk is an open-source help desk/ticketing solution.
http://trudesk.io
Other
1.29k stars 430 forks source link

Security Issue - Bypass of Rate Limiting Mechanism #667

Closed Sn1r closed 2 months ago

Sn1r commented 4 months ago

Is this a BUG REPORT or FEATURE REQUEST?:

What happened: The vulnerability includes a bypass in the implementation of the rate-limiting mechanism, which blocks a malicious actor’s IP address while performing suspicious login attempts toward the system's authentication mechanism. This can be done by appending the "X-Forwarded-For" header to each login request and by that, the backend "considers" this as a new IP address, allowing to carry on with a successful brute force attack.

What did you expect to happen: Avoid IP spoofing by unsetting the X-Forwarded-For header to determine the originated user’s IP address. If not possible, prevent spoofing of the X-Forwarded-For header in Node.js by configuring Express to trust only specific proxies with known IP ranges using the trustProxy setting and verifying the IP address against a whitelist.

How to reproduce it (as minimally and precisely as possible):

  1. Access the system's login page prior to the authentication phase.
  2. Send multiple login requests to a single user with invalid passwords.
  3. Notice the HTTP 429 status code returned in the response after a couple of attempts, indicating the IP address has been blocked temporarily.
  4. Add the "X-Forwarded-For" header to the request using Proxy tools and set it to a different value on each attempt. (e.g., 127.0.0.1, 127.0.0.2, 127.0.0.3).
  5. Proceed with the brute force attack until a successful attempt has been made to guess the correct user's password.
  6. Obtain unauthorized access to the system using an admin account, for example.

Anything else we need to know?: Nothing else. I'm available for further questions.

Environment:

Below is a PoC:

https://github.com/polonel/trudesk/assets/71400526/76de836c-934d-43b3-86e9-ec926cf454c5

github-actions[bot] commented 3 months ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

Sn1r commented 3 months ago

Hi, any feedback?

github-actions[bot] commented 2 months ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

github-actions[bot] commented 2 months ago

This issue was closed because it has been stalled for 5 days with no activity.