CVE-2022-4006: Improper Restriction of Excessive Authentication Attempts (CWE-307)
value: A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The name of the patch is d394ba39a7bfeb31eda797b6195fd90ef74b2e75. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213716.
CWE description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVSS v3 base score: 7.5
Published: 2022-11-15T22:15Z
Repository: https://github.com/wbce/wbce_cms
Language: PHP
Files changed: wbce/framework/class.login.php
Commit date: 2022-11-13 22:31:22 +0100
Commit message: fix for #524

usually, ip addresses with multiple failed login attempts should be
blocked. An attacker could bypass this by sending an X-forwarded-for
header and change that IP with each attempt. Since REMMOTE_ADDR
is harder to fake we should first check that one and only if that one is
not set for some reason, rely on other variables.

Diff: diff --git a/wbce/framework/class.login.php b/wbce/framework/class.login.php
index 8cee7186..325fa264 100644
--- a/wbce/framework/class.login.php
+++ b/wbce/framework/class.login.php
@@ -408,35 +408,36 @@ class Login extends Admin
     /**
      * @brief  get the client ip address from various php or environment variables
      */
     private function get_client_ip()
     {
-        $ipaddress = '';
-        if (isset($_SERVER['HTTP_CLIENT_IP'])) {
+	$ipaddress = '';
+	// for security reasons first check remote_addr which is more difficult to fake:
+	if (isset($_SERVER['REMOTE_ADDR'])) {
+	    $ipaddress = $this->get_server('REMOTE_ADDR');
+	} elseif (getenv('REMOTE_ADDR')) {
+	    $ipaddress = getenv('REMOTE_ADDR');
+	} elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
             $ipaddress = $this->get_server('HTTP_CLIENT_IP');
         } elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
             $ipaddress = $this->get_server('HTTP_X_FORWARDED_FOR');
         } elseif (isset($_SERVER['HTTP_X_FORWARDED'])) {
             $ipaddress = $this->get_server('HTTP_X_FORWARDED');
         } elseif (isset($_SERVER['HTTP_FORWARDED_FOR'])) {
             $ipaddress = $this->get_server('HTTP_FORWARDED_FOR');
         } elseif (isset($_SERVER['HTTP_FORWARDED'])) {
             $ipaddress = $this->get_server('HTTP_FORWARDED');
-        } elseif (isset($_SERVER['REMOTE_ADDR'])) {
-            $ipaddress = $this->get_server('REMOTE_ADDR');
         } elseif (getenv('HTTP_CLIENT_IP')) {
             $ipaddress = getenv('HTTP_CLIENT_IP');
         } elseif (getenv('HTTP_X_FORWARDED_FOR')) {
             $ipaddress = getenv('HTTP_X_FORWARDED_FOR');
         } elseif (getenv('HTTP_X_FORWARDED')) {
             $ipaddress = getenv('HTTP_X_FORWARDED');
         } elseif (getenv('HTTP_FORWARDED_FOR')) {
             $ipaddress = getenv('HTTP_FORWARDED_FOR');
         } elseif (getenv('HTTP_FORWARDED')) {
             $ipaddress = getenv('HTTP_FORWARDED');
-        } elseif (getenv('REMOTE_ADDR')) {
-            $ipaddress = getenv('REMOTE_ADDR');
         } else {
             $ipaddress = 'UNKNOWN';
         }
 
         return $ipaddress;

Vulnerable code:         $ipaddress = '';
        if (isset($_SERVER['HTTP_CLIENT_IP'])) {
        } elseif (isset($_SERVER['REMOTE_ADDR'])) {
            $ipaddress = $this->get_server('REMOTE_ADDR');
        } elseif (getenv('REMOTE_ADDR')) {
            $ipaddress = getenv('REMOTE_ADDR');
Fixed code: 	$ipaddress = '';
	// for security reasons first check remote_addr which is more difficult to fake:
	if (isset($_SERVER['REMOTE_ADDR'])) {
	    $ipaddress = $this->get_server('REMOTE_ADDR');
	} elseif (getenv('REMOTE_ADDR')) {
	    $ipaddress = getenv('REMOTE_ADDR');
	} elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {