CVE-2019-15929: Craft CMS Brute Force Vulnerability
Summary
CVE-2019-15929: Craft CMS possibility of brute force attempts. Affects craftcms/cms versions < 3.1.7. Fixed in 3.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a popular content management system used for building websites and web applications. It provides a range of features and functionalities for managing content, user authentication, and more. Craft CMS is vulnerable to a brute force attack due to a lack of rate limiting on the elevated session password prompt. This vulnerability allows an attacker to repeatedly attempt to guess the password for an elevated session, potentially gaining unauthorized access to sensitive information or performing malicious actions.
Vulnerability Detail
The vulnerability in Craft CMS arises from the elevated session password prompt not being rate limited like normal login forms. This means that an attacker can launch a brute force attack by repeatedly guessing passwords until they find the correct one. The lack of rate limiting makes it easier for an attacker to guess the password within a short period of time. Successful exploitation of this vulnerability can lead to unauthorized access, data breaches, or other malicious activities.
How To Fix
Minimum fixed version
3.1.7
This is the first release that contains the fix.
composer require craftcms/cms:3.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional security measures such as IP blocking or CAPTCHA on the elevated session password prompt. These measures can help mitigate the risk of brute force attacks while waiting for the official update. Here is an example of how to implement IP blocking in Craft CMS:
- Install the 'craft-ip-blocker' plugin from the Craft Plugin Store.
- Configure the plugin to block IP addresses after a certain number of failed login attempts.
- Enable the plugin and test its functionality to ensure it effectively blocks unauthorized access.
Conclusion
The Craft CMS brute force vulnerability allows attackers to launch unlimited password guessing attempts on the elevated session password prompt. To mitigate this risk, it is crucial to update Craft CMS to version 3.1.7 or later, which includes rate limiting on the password prompt. In the meantime, implementing additional security measures like IP blocking can provide temporary protection. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is a content management system used for building websites and web applications. It provides a range of features for managing content, user authentication, and more.
A brute force attack is a hacking technique where an attacker attempts to guess a password by systematically trying all possible combinations until the correct one is found.
The lack of rate limiting on the elevated session password prompt allows an attacker to make unlimited password guesses within a short period of time, increasing the chances of finding the correct password through brute force.
A successful brute force attack on Craft CMS can result in unauthorized access to sensitive information, data breaches, manipulation of content, or other malicious activities.
To protect your Craft CMS installation from brute force attacks, it is recommended to update to the latest version, implement strong passwords, enable rate limiting, and consider additional security measures such as IP blocking or CAPTCHA.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
