| शीर्षक | LogicalDOC Community 9.2.1 Improper Restriction of Excessive Authentication Attempts |
|---|
| विवरण | Summary
The admin login page of LogicalDOC v9.2.1 is susceptible to unauthenticated credential brute-force. An attacker can automate password guessing against the /login.jsp endpoint and determine valid credentials by differences in HTTP response (status code and response length), allowing full takeover of the admin account.
Steps to Reproduce
1. Navigate to http://lg.htb:8080/login.jsp
2. Capture a valid login request with Burp Suite
3. Send the captured request to Intruder
4. Set the body/form parameters such that the username is fixed and the password is a payload position, e.g.: j_username=admin&j_password=§admin§
5. Load a password list (used example: the 500 worst passwords list: https://gist.github.com/djaiss/4033452) into Intruder
Incorrect Password attempt returns Status Code: 302 and Response Length: 675
Correct Password attempt returns Status Code: 200 and Response Length: 796)
6. The correct password is identified and admin access is gained — confirming admin account takeover via password brute forcing
Impact
*) Full admin account takeover possible via automated credential guessing.
*) Unauthorized access to sensitive documents and configuration.
*) Ability to modify or delete data and create privileged accounts.
*) Potential lateral movement and persistence after compromise.
*) Regulatory, compliance, and reputational exposure.
Recommendation
*) Implement account lockout or progressive rate-limiting after failed attempts.
*) Enforce multi-factor authentication (MFA) for all admin accounts.
*) Normalize authentication responses (same status/body for success and failure).
*) Introduce CAPTCHA or adaptive challenges after suspicious activity.
*) Block or throttle suspicious IPs and use WAF rules to detect automation. |
|---|
| उपयोगकर्ता | Zeeshan Khan (UID 91384) |
|---|
| सबमिशन | 16/10/2025 07:00 PM (1 वर्ष पहले) |
|---|
| संयम | 31/10/2025 02:10 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 330807 [LogicalDOC Community Edition तक 9.2.1 Admin Login Page /login.jsp सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|