The vulnerability arises from the absence of rate limiting for reset_code requests. Attackers exploit this by repeatedly resetting admin passwords until the correct reset_code is obtained, becoming administrators.
The flaw is in /opt/logsign-api/api.py, where resetting passwords occurs. Despite a 3-minute time check on reset_code expiry, it doesn't prevent multiple attempts within the window, making brute-force attacks feasible.
Collection
[
|
...
]