WS-2022-0198

Improperly Configured rackattack.rb does not prevent rate limit attacks in lobsters/lobsters...

WS-2022-0233

Zammad's Misconfigured RackAttack.rb Does Not Appropriately Protect Against Brute Force Attacks in zammad/zammad from 5.2.x and before 5.2.1...

Mastadon's Misconfigured Rack_Attack.rb Does Not Appropriately Protect Against Brute Force Attacks

Description Mastadon relies on the RackAttack.rb file to manage API throttling in the application through the declaration of absolute paths i.e., /auth/signin. By appending random strings of characters to the end of the directory in a POST request it is possible to bypass brute force protections...