Description

The /api/authorize.json login endpoint is susceptible to credential-stuffing / brute-force attacks against both username and password because there is no effective rate limiting, progressive backoff, account lockout, or bot mitigation (e.g., CAPTCHA) by default. The endpoint returns a deterministic error response for invalid credentials which can be used by an attacker to script password-guessing at scale, increasing the risk of account takeover.

Reproduce

1. Open the login UI: http://10.0.0.94/desktop#/login.
2. Intercept a normal login attempt with a proxy (Burp Suite, etc.). Example request (trimmed/redacted):

POST /api/authorize.json HTTP/1.1
Host: 10.0.0.94
Content-Type: application/json
Origin: http://10.0.0.94/
Referer: http://10.0.0.94/desktop

{"loginName":"man1","password":"1234567890"}

3. Submit a wrong password and observe the response body:

{"errorCode":201002,"errorMessage":"login name or password is wrong","path":"/api/authorize.json","success":false}

4. Automate: use the consistent error code/message as a condition in a script to iterate many username/password combinations. Because there are no throttles or progressive delays, the attacker can rapidly enumerate/guess credentials until one succeeds.

Recommendation

• Enforce rate limits & backoff: Apply per-account, per-IP, and per-endpoint rate limiting. Introduce progressive delays (exponential backoff) after failed attempts.
• Account lockout / cooldown: Temporarily lock or require additional verification after a configurable number of failed attempts (e.g., lock for N minutes after 5–10 failures). Ensure lockout notifications are sent to the account owner.
• Anti-bot protections: Add CAPTCHAs or challenge-response (adaptive: after suspicious behavior or repeated failures) and integrate bot-detection / device-fingerprinting for high-volume sources.
• Avoid revealing valid usernames: Return a generic authentication failure message that does not confirm whether the username or password was incorrect.
• Multi-factor authentication: Encourage/require MFA for high-risk accounts and for sensitive actions; enforce it during authentication flows.
• Credential stuffing defenses: Block known compromised credentials, use breached-password checks (e.g., Pwned Passwords), and throttle repeated attempts using the same username across different IPs.
• Monitoring & alerting: Log failed-login patterns, alert on rapid/large-scale failures, and create dashboards for unusual authentication activity.
• WAF & IP reputation: Deploy WAF rules and IP reputation / rate-limiting at the edge to slow automated attacks.
• Secure password handling: Ensure the backend uses salted, slow password hashing (e.g., Argon2/Bcrypt) and does not leak timing or error details.
• Progressive rollout & testing: Add unit/integration tests for rate-limiting and lockout logic and perform pen tests / red-team exercises to validate mitigations.

Applying a combination of rate-limiting, account lockouts, anti-bot measures, MFA, and improved logging will substantially reduce the risk from automated brute-force and credential-stuffing attacks.