-
Type: Bug
-
Status: Open
-
Priority: Minor
-
Resolution: Unresolved
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: Security, Security / Rights
Server Security Misconfiguration > No Rate Limiting on Form > Login
Proof of Concept
- Browse "https://pentest.beta.nuxeocloud.com/nuxeo/login.jsp" URL for login attempt
- Place a random username and password in username and password areas,
- Use a proxy tool like burpsuite to intercept HTTP traffic.
- Click "Log in" button on login page.
- Intercept and send the request to the Intruder module on burpsuite tool.
- Clear all reference point and place only a reference on "password" parameter.
- On Payloads tab, use wordlist
- Start attack and observe how the login form is vulnerable to the brute force attack.
Suggested Fix
implement multi-factor authentication