| 제목 | siteserver SiteServer CMS (SSCMS) 7.4.0 Improper Restriction of Excessive Authentication Attempts |
|---|
| 설명 | A vulnerability was found in SiteServer CMS (SSCMS) 7.4.0. The administrator login endpoint POST /api/admin/login skips CAPTCHA verification when the JSON request body contains the field "isForceLogoutAndLogin" set to true. This argument is attacker-controlled and is checked before authentication, in src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs line 46:
if (!request.IsForceLogoutAndLogin && !config.IsAdminCaptchaDisabled) { ... CAPTCHA check ... }
When the attacker sets this flag to true, the CAPTCHA block is skipped entirely and no CAPTCHA token is required. The member login path (src/SSCMS.Web/Controllers/Home/LoginController.Submit.cs line 44) does not contain this bypass, confirming the admin-side flag is unintended. The application has no rate-limiting middleware and failed-login lockout is disabled by default (Config.IsAdminLockLogin = false), and the default admin password policy is weak (minimum length 6, letters and digits), so removing the CAPTCHA permits unlimited automated password guessing against administrator accounts. The manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts (CWE-307). The attack can be launched remotely and requires no prior authentication.
Affected endpoint: POST /api/admin/login
Affected parameter: isForceLogoutAndLogin
Proof of Concept (the password is sent as md5(password), as the web UI does):
1) CAPTCHA enforced (baseline, request rejected):
POST /api/admin/login
{"account":"admin","password":"<md5(password)>"}
Response: {"message":"验证码已超时，请点击刷新验证码！"}
2) CAPTCHA bypassed (same request plus the flag, no CAPTCHA sent, login succeeds):
POST /api/admin/login
{"account":"admin","password":"<md5(password)>","isForceLogoutAndLogin":true}
Response: {"isLoginExists":false,"administrator":{...},"token":"eyJ..."}
3) The returned JWT is a valid admin session:
GET /api/admin/dashboard with header Authorization: Bearer <token> -> HTTP 200
4) Negative control (wrong password plus the flag still fails, proving the CAPTCHA and not authentication is bypassed):
Response: {"message":"账号或密码错误"}
The only difference between request (1) and request (2) is the single field "isForceLogoutAndLogin": true. Verified against the official Docker image sscms/core:latest (version 7.4.0).
Suggested fix: require a valid CAPTCHA on every pre-authentication attempt and do not let the client waive it via isForceLogoutAndLogin; enable login lockout and server-side rate limiting by default.
CVSS 3.1 Base Score 5.3 (Medium): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
|---|
| 사용자 | The_S7s (UID 102172) |
|---|
| 제출 | 2026. 10. 16. AM 12:11 (24 날 ago) |
|---|
| 모더레이션 | 2026. 11. 08. PM 05:58 (24 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 432921 [SiteServer SSCMS 까지 7.1.3/7.2.1/7.4.0 Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit isForceLogoutAndLogin 정보 공개] |
|---|
| 포인트들 | 20 |
|---|