Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerability: No rate limit on reset password link #3214

Closed
martaribeiro opened this issue Sep 29, 2022 · 3 comments
Closed

Vulnerability: No rate limit on reset password link #3214

martaribeiro opened this issue Sep 29, 2022 · 3 comments
Assignees
@martaribeiro @johnpinto1
Labels
effort-small less than 1/2 day of dev time security vulnerability Vulnerability in the code

Comments

@martaribeiro
Copy link
Contributor

Please complete the following fields as applicable:

What version of the DMPRoadmap code are you running? (e.g. v2.2.0)
Roadmap V3.1.1

Expected behaviour:
Only send one reset password email within a certain period of time.

Actual behaviour:
DESCRIPTION: A user will get many password reset link in the mailbox and unwanted traffic will be generated in the mailbox

STEPS TO REPRODUCE:

  1. create an account and activate
  2. logout and then go to forget password section enter your email id
  3. open burp suite in proxy make intercept on and then in browser click on forget password
  4. forget password traffic will be generated on burp suite search for your email address if it is there simply send it to intruder
  5. in intruder in position select attack type sniper then click on clear once then add two '$' in front of user agent
  6. in payload select brute force and in character set select ab so it will send 16 mail link if you choose abc it will send more then click on start attack then if traffic of 200 is generated then its a bug

IMPACT: User inbox will generated unwanted password in their mailbox

Steps to reproduce:
Set a number of emails sent in a certain period of time when reseting password
@martaribeiro martaribeiro added usability vulnerability Vulnerability in the code and removed usability labels Sep 29, 2022
@dsisu
Copy link

dsisu commented Oct 12, 2022

Solution: insert a minimum time in between password resets, e.g. 2 mins.

@dsisu
Copy link

dsisu commented Oct 12, 2022

@dsisu to investigate whether there is an industry practice on limits to number of password changes

@briri briri added effort-small less than 1/2 day of dev time security labels Nov 21, 2022
@johnpinto1 johnpinto1 self-assigned this Nov 28, 2022
@johnpinto1
Copy link
Contributor

Going to use Rack-attack gem https://rubygems.org/gems/rack-attack/versions/6.6.1 as suggested by @briri.

johnpinto1 pushed a commit that referenced this issue Dec 8, 2022
Fix for bug #3214 which had noted there was no request rate limit to
8497198 
resetting the password.

The Rack-Attack middleware for blocking & throttling abusive requests is
being used.
https://github.com/rack/rack-attack/blob/6-stable/README.md

Changes:
- Added rack-attack version 6.6.1 gem. https://rubygems.org/gems/rack-attack/versions/6.6.1
- Added config/initializers/rack_attack.rb:
  - The rack-attack functionality is enabled with
        Rack::Attack.enabled = true
    but may be switched off
        Rack::Attack.enabled = false.
  - Password reset requests are currently throttled from an ip addr from an ip address
    for POSTs to path /users/passwords and is limited 2 requests every 30 seconds.
ess
  - Login requests are throttled  from an ip address
    for POSTs to path /users/sign_in and is limited 4 requests every 30 seconds.  - A new html page public/429.html with title "Too Many Request" is added.
@johnpinto1 johnpinto1 mentioned this issue Dec 8, 2022
Merged
johnpinto1 pushed a commit that referenced this issue Dec 8, 2022
Fix for bug #3214 which had noted there was no request rate limit to
cbff267 
resetting the password.

The Rack-Attack middleware for blocking & throttling abusive requests is
being used.
https://github.com/rack/rack-attack/blob/6-stable/README.md

Changes:
- Added rack-attack version 6.6.1 gem. https://rubygems.org/gems/rack-attack/versions/6.6.1
- Added config/initializers/rack_attack.rb:
  - The rack-attack functionality is enabled with
        Rack::Attack.enabled = true
    but may be switched off
        Rack::Attack.enabled = false.
  - Password reset requests are currently throttled from from an IP address
    for POSTs to path /users/passwords and is limited 2 requests every 30 seconds.
ess
  - Login requests are throttled  from an IP address
    for POSTs to path /users/sign_in and is limited 4 requests every 30 seconds.  - A new html page public/429.html with title "Too Many Request" is added.
johnpinto1 pushed a commit that referenced this issue Dec 19, 2022
Fix for bug #3214 which had noted there was no request rate limit to
94ef895 
resetting the password.

The Rack-Attack middleware for blocking & throttling abusive requests is
being used.
https://github.com/rack/rack-attack/blob/6-stable/README.md

Changes:
- Added rack-attack version 6.6.1 gem. https://rubygems.org/gems/rack-attack/versions/6.6.1
- Added config/initializers/rack_attack.rb:
  - The rack-attack functionality is enabled with
        Rack::Attack.enabled = true
    but may be switched off
        Rack::Attack.enabled = false.
  - Password reset requests are currently throttled from from an IP address
    for POSTs to path /users/passwords and is limited 2 requests every 30 seconds.
ess
  - Login requests are throttled  from an IP address
    for POSTs to path /users/sign_in and is limited 4 requests every 30 seconds.  - A new html page public/429.html with title "Too Many Request" is added.
johnpinto1 pushed a commit that referenced this issue Dec 19, 2022
Fix for bug #3214 which had noted there was no request rate limit to
d809377 
resetting the password.

The Rack-Attack middleware for blocking & throttling abusive requests is
being used.
https://github.com/rack/rack-attack/blob/6-stable/README.md

Changes:
- Added rack-attack version 6.6.1 gem. https://rubygems.org/gems/rack-attack/versions/6.6.1
- Added config/initializers/rack_attack.rb:
  - The rack-attack functionality is enabled with
        Rack::Attack.enabled = true
    but may be switched off
        Rack::Attack.enabled = false.
  - Password reset requests are currently throttled from from an IP address
    for POSTs to path /users/passwords and is limited 2 requests every 30 seconds.
ess
  - Login requests are throttled  from an IP address
    for POSTs to path /users/sign_in and is limited 4 requests every 30 seconds.  - A new html page public/429.html with title "Too Many Request" is added.
johnpinto1 pushed a commit that referenced this issue Jan 10, 2023
Fix for bug #3214 which had noted there was no request rate limit to
71c9e55 
resetting the password.

The Rack-Attack middleware for blocking & throttling abusive requests is
being used.
https://github.com/rack/rack-attack/blob/6-stable/README.md

Changes:
- Added rack-attack version 6.6.1 gem. https://rubygems.org/gems/rack-attack/versions/6.6.1
- Added config/initializers/rack_attack.rb:
  - The rack-attack functionality is enabled with
        Rack::Attack.enabled = true
    but may be switched off
        Rack::Attack.enabled = false.
  - Password reset requests are currently throttled from from an IP address
    for POSTs to path /users/passwords and is limited 2 requests every 30 seconds.
ess
  - Login requests are throttled  from an IP address
    for POSTs to path /users/sign_in and is limited 4 requests every 30 seconds.  - A new html page public/429.html with title "Too Many Request" is added.
briri added a commit that referenced this issue Mar 24, 2023
@briri
Merge pull request #3261 from DMPRoadmap/bug-3214-vulnerability_no_ra…
5ac38d3 
…te_limit_on_reset_password_link

Fix for bug #3214 which had noted there was no request rate limit to - WIP
@briri briri mentioned this issue Apr 12, 2023
Merged
@briri briri closed this as completed Apr 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@martaribeiro martaribeiro

@johnpinto1 johnpinto1

Labels
effort-small less than 1/2 day of dev time security vulnerability Vulnerability in the code
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@briri @dsisu @martaribeiro @johnpinto1