CVE-2024-24767: Insufficient Information (NVD-CWE-noinfo)
value: CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-06T18:15Z
Repository: https://github.com/IceWhaleTech/CasaOS-UserService
Language: Other
Files changed: go.mod, route/v1/user.go
Commit date: 2024-02-05 14:15:00 +0800
Commit message: Merge pull request from GHSA-c69x-5xmw-v44x

* feat: limit too many login request

* fix: fix error rate limt

---------

Signed-off-by: CorrectRoadH <a778917369@gmail.com>
Diff: diff --git a/go.mod b/go.mod
index a2829b2..fe75d9f 100644
--- a/go.mod
+++ b/go.mod
@@ -13,10 +13,11 @@ require (
 	github.com/labstack/echo/v4 v4.10.2
 	github.com/satori/go.uuid v1.2.0
 	github.com/tidwall/gjson v1.14.4
 	go.uber.org/zap v1.24.0
 	golang.org/x/net v0.17.0
+	golang.org/x/time v0.3.0
 	gopkg.in/ini.v1 v1.67.0
 	gorm.io/gorm v1.25.0
 )
 
 require (
@@ -73,11 +74,10 @@ require (
 	golang.org/x/arch v0.3.0 // indirect
 	golang.org/x/crypto v0.14.0 // indirect
 	golang.org/x/exp v0.0.0-20230713183714-613f0c0eb8a1 // indirect
 	golang.org/x/sys v0.14.0 // indirect
 	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.22.4 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
diff --git a/route/v1/user.go b/route/v1/user.go
index 90a7c01..03def9c 100644
--- a/route/v1/user.go
+++ b/route/v1/user.go
@@ -30,10 +30,11 @@ import (
 	"github.com/IceWhaleTech/CasaOS-UserService/pkg/utils/file"
 	model2 "github.com/IceWhaleTech/CasaOS-UserService/service/model"
 	uuid "github.com/satori/go.uuid"
 	"github.com/tidwall/gjson"
 	"go.uber.org/zap"
+	"golang.org/x/time/rate"
 
 	"github.com/IceWhaleTech/CasaOS-UserService/service"
 	"github.com/gin-gonic/gin"
 )
 
@@ -82,19 +83,31 @@ func PostUserRegister(c *gin.Context) {
 	file.MkDir(config.AppInfo.UserDataPath + "/" + strconv.Itoa(user.Id))
 	delete(service.UserRegisterHash, key)
 	c.JSON(common_err.SUCCESS, model.Result{Success: common_err.SUCCESS, Message: common_err.GetMsg(common_err.SUCCESS)})
 }
 
+var limiter = rate.NewLimiter(rate.Every(time.Minute), 5)
+
 // @Summary login
 // @Produce  application/json
 // @Accept application/json
 // @Tags user
 // @Param user_name query string true "User name"
 // @Param pwd  query string true "password"
 // @Success 200 {string} string "ok"
 // @Router /user/login [post]
 func PostUserLogin(c *gin.Context) {
+
+	if !limiter.Allow() {
+		c.JSON(common_err.TOO_MANY_REQUEST,
+			model.Result{
+				Success: common_err.TOO_MANY_LOGIN_REQUESTS,
+				Message: common_err.GetMsg(common_err.TOO_MANY_LOGIN_REQUESTS),
+			})
+		return
+	}
+
 	json := make(map[string]string)
 	c.ShouldBind(&json)
 
 	username := json["username"]
 

Vulnerable code: 	golang.org/x/time v0.3.0 // indirect
Fixed code: 	golang.org/x/time v0.3.0
	"golang.org/x/time/rate"
var limiter = rate.NewLimiter(rate.Every(time.Minute), 5)


	if !limiter.Allow() {
		c.JSON(common_err.TOO_MANY_REQUEST,
			model.Result{
				Success: common_err.TOO_MANY_LOGIN_REQUESTS,
				Message: common_err.GetMsg(common_err.TOO_MANY_LOGIN_REQUESTS),
			})
		return
	}