PT-2021-23146 · Elabftw · Elabftw

Krastanoel · Published 2021-10-22 · Updated 2021-10-28 · CVE-2021-41171

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eLabFTW versions prior to 4.1.0

Description The issue allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in the HTTP Cookie header. This has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies, which will effectively thwart any brute-force attempts at guessing passwords.

Recommendations For versions prior to 4.1.0, the only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is a valid option, with or without upgrading.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2021-41171

GHSA-Q67H-5PC3-G6JV

Affected Products

Elabftw

References · 9

• 🔥 https://exploit-db.com/docs/50436 · Exploit
• https://github.com/elabftw/elabftw/commit/8e92afeec4c3a68dc88333881b7e6307f425706b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41171 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41171 · Vendor Advisory
• https://github.com/elabftw/elabftw/security/advisories/GHSA-q67h-5pc3-g6jv · Note
• https://github.com/elabftw/elabftw/releases/tag/4.1.0 · Note
• https://t.me/cibsecurity/31057 · Telegram Post
• https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies · Note
• https://t.me/cvenotify/22572 · Telegram Post