PT-2020-12513 · Sorcery · Sorcery

Futuretap · Published 2020-05-07 · Updated 2020-05-13 · CVE-2020-11052

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sorcery versions prior to 0.15.0

Description The issue is related to a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule prevents a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout.

Recommendations For Sorcery versions prior to 0.15.0, upgrade to version 0.15.0 to resolve the issue. As a temporary workaround, consider monkey patching the authenticate method provided by Sorcery until a patch is available.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2020-11052

GHSA-JC8M-CXHJ-668X

Affected Products

Sorcery

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sorcery/CVE-2020-11052.yml · Exploit
• https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7 · Patch
• https://github.com/Sorcery/sorcery/pull/235 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11052 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11052 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jc8m-cxhj-668x · Vendor Advisory
• https://github.com/Sorcery/sorcery/issues/231 · Note
• https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x · Note
• https://github.com/Sorcery/sorcery · Note
• https://t.me/cvenotify/3655 · Telegram Post