CVE-2022-2650: Improper Restriction of Excessive Authentication Attempts (CWE-307)
value: Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
CWE description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVSS v3 base score: 9.8
Published: 2022-11-24T17:15Z
Repository: https://github.com/wger-project/wger
Language: Other
Files changed: extras/docker/development/settings.py, requirements.txt
Commit date: 2022-10-13 16:24:29 +0200
Commit message: Merge branch 'master' into add-django-axes
Diff: diff --cc extras/docker/development/settings.py
index f63cae05,311fb3e0..b3c5a72b
--- a/extras/docker/development/settings.py
+++ b/extras/docker/development/settings.py
@@@ -114,11 -114,11 +114,18 @@@ if os.environ.get("DJANGO_CACHE_BACKEND
  COMPRESS_ROOT = STATIC_ROOT
  
  # The site's domain as used by the email verification workflow
  EMAIL_PAGE_DOMAIN = 'http://localhost/'
  
 +
 +# Django Axes
 +AXES_ENABLED = True  # allow to disable axes entirely (e.g. if this is run in a local network or so we would save up some resources), but default is true
 +AXES_FAILURE_LIMIT = 5  # configurable, default is 5
 +AXES_COOLOFF_TIME = 0.5  # configurable, default is 0.5 hours
 +AXES_HANDLER = 'axes.handlers.cache.AxesCacheHandler'  # Configurable, but default is the cache handler
++
+ #
+ # Django Rest Framework SimpleJWT
+ #
+ SIMPLE_JWT['ACCESS_TOKEN_LIFETIME'] = timedelta(minutes=env.int("ACCESS_TOKEN_LIFETIME", 15))
+ SIMPLE_JWT['REFRESH_TOKEN_LIFETIME'] = timedelta(hours=env.int("REFRESH_TOKEN_LIFETIME", 24))
 -SIMPLE_JWT['SIGNING_KEY'] = env.str("SIGNING_KEY", SECRET_KEY)
++SIMPLE_JWT['SIGNING_KEY'] = env.str("SIGNING_KEY", SECRET_KEY)
diff --cc requirements.txt
index f6bea32b,c3eefb86..810e6a99
--- a/requirements.txt
+++ b/requirements.txt
@@@ -7,14 -7,13 +7,14 @@@ bleach[css]~=5.
  django-bootstrap-breadcrumbs~=0.9
  django-formtools~=2.4
  django-recaptcha~=3.0.0
  Django~=3.2
  django-activity-stream~=1.4
 +django-axes==5.39.0
  django-crispy-forms~=1.14
  django-simple-history~=3.1
- django-email-verification~=0.1.0
+ django-email-verification~=0.3.1
  django_compressor~=4.1
  django_extensions~=3.2
  django-storages~=1.13
  django-environ==0.9.0
  easy-thumbnails==2.8.3
diff --cc wger/settings_global.py
index 8130583b,b1a61a24..c7afab45
--- a/wger/settings_global.py
+++ b/wger/settings_global.py
@@@ -404,22 -379,23 +406,23 @@@ COMPRESS_ROOT = STATIC_ROO
  
  #
  # Django Rest Framework
  #
  REST_FRAMEWORK = {
 -    'DEFAULT_PERMISSION_CLASSES': ('wger.utils.permissions.WgerPermission', ),
 +    'DEFAULT_PERMISSION_CLASSES': ('wger.utils.permissions.WgerPermission',),
      'DEFAULT_PAGINATION_CLASS':
 -    'rest_framework.pagination.LimitOffsetPagination',
 +        'rest_framework.pagination.LimitOffsetPagination',
      'PAGE_SIZE':
 -    20,
 +        20,
      'PAGINATE_BY_PARAM':
 -    'limit',  # Allow client to override, using `?limit=xxx`.
 +        'limit',  # Allow client to override, using `?limit=xxx`.
      'TEST_REQUEST_DEFAULT_FORMAT':
 -    'json',
 +        'json',
      'DEFAULT_AUTHENTICATION_CLASSES': (
          'rest_framework.authentication.SessionAuthentication',
          'rest_framework.authentication.TokenAuthentication',
+         'rest_framework_simplejwt.authentication.JWTAuthentication',
      ),
      'DEFAULT_FILTER_BACKENDS': (
          'django_filters.rest_framework.DjangoFilterBackend',
          'rest_framework.filters.OrderingFilter',
      ),

Vulnerable code:  django-email-verification~=0.1.0
Fixed code: +
 #
 # Django Rest Framework SimpleJWT
 #
 SIMPLE_JWT['ACCESS_TOKEN_LIFETIME'] = timedelta(minutes=env.int("ACCESS_TOKEN_LIFETIME", 15))
 SIMPLE_JWT['REFRESH_TOKEN_LIFETIME'] = timedelta(hours=env.int("REFRESH_TOKEN_LIFETIME", 24))
+SIMPLE_JWT['SIGNING_KEY'] = env.str("SIGNING_KEY", SECRET_KEY)
 django-email-verification~=0.3.1