PT-2020-17356 · WordPress · Limit-Login-Attempts-Reloaded
N4Nj0
·
Published
2020-12-21
·
Updated
2020-12-22
·
CVE-2020-35590
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
limit-login-attempts-reloaded plugin versions prior to 2.17.4 for WordPress
Description
The issue allows a bypass of rate limits per IP address because the
X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user can perform a brute force attack without being limited, as the client IP header accepts any arbitrary string. This is possible when randomizing the header input, resulting in the login count never reaching the maximum allowed retries.Recommendations
For limit-login-attempts-reloaded plugin versions prior to 2.17.4, update to version 2.17.4 or later to resolve the issue.
As a temporary workaround, consider disabling the acceptance of arbitrary headers for the client source IP address until a patch is available.
Restrict access to the
LimitLoginAttempts.php file to minimize the risk of exploitation.
Avoid using the X-Forwarded-For header in the affected plugin until the issue is resolved.Exploit
Fix
Improper Restriction of Excessive Authentication Attempts
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Limit-Login-Attempts-Reloaded