PT-2020-20310 · Intuit · Argo Api
Published
2020-04-08
·
Updated
2024-08-21
·
CVE-2020-8827
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Argo API version 1.5.0
Description
The Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures, allowing attackers to submit an unlimited number of authentication attempts without consequence. This makes the application susceptible to brute force attacks, compromising the security of all user accounts. An attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. The issue arises from the application crashing due to a DoS vulnerability and saving data of failed login attempts in-memory, without persistent storage, which is lost when the application crashes and restarts, resetting the brute force protections.
Recommendations
As a temporary workaround, consider implementing rate limiting or account lockouts to prevent excessive authentication attempts.
Restrict access to the
LoginAttempts struct to minimize the risk of exploitation.
Avoid using the LastFailed and FailCount variables in the LoginAttempts struct until the issue is resolved.
Update to a version that implements anti-automation measures, such as rate limiting and account lockouts, to prevent brute force attacks.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Improper Restriction of Excessive Authentication Attempts
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Argo Api