CVE-2022-2321 (Go, published 2022-07-05T19:15Z)
Description: value: Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/heroiclabs/nakama
Files changed:
main.go
server/console.go
server/console_authenticate.go
server/login_attempt_cache.go
Commit message: Better limit for unsuccessful login attempts on the devconsole. (#878)



Vulnerable code:
	consoleServer := server.StartConsoleServer(logger, startupLogger, db, config, tracker, router, streamManager, sessionCache, consoleSessionCache, statusRegistry, statusHandler, runtimeInfo, matchRegistry, configWarnings, semver, leaderboardCache, leaderboardRankCache, apiServer, cookie)
func StartConsoleServer(logger *zap.Logger, startupLogger *zap.Logger, db *sql.DB, config Config, tracker Tracker, router MessageRouter, streamManager StreamManager, sessionCache SessionCache, consoleSessionCache SessionCache, statusRegistry *StatusRegistry, statusHandler StatusHandler, runtimeInfo *RuntimeInfo, matchRegistry MatchRegistry, configWarnings map[string]string, serverVersion string, leaderboardCache LeaderboardCache, leaderboardRankCache LeaderboardRankCache, api *ApiServer, cookie string) *ConsoleServer {
	"github.com/gofrs/uuid"
	"google.golang.org/protobuf/types/known/emptypb"
		id, uname, email, role, err = s.lookupConsoleUser(ctx, in.Username, in.Password)
func (s *ConsoleServer) lookupConsoleUser(ctx context.Context, unameOrEmail, password string) (id uuid.UUID, uname string, email string, role console.UserRole, err error) {
			err = nil

Fixed code:
	loginAttemptCache := server.NewLocalLoginAttemptCache()
	consoleServer := server.StartConsoleServer(logger, startupLogger, db, config, tracker, router, streamManager, sessionCache, consoleSessionCache, loginAttemptCache, statusRegistry, statusHandler, runtimeInfo, matchRegistry, configWarnings, semver, leaderboardCache, leaderboardRankCache, apiServer, cookie)
	loginAttemptCache.Stop()
	loginAttemptCache    LoginAttemptCache
func StartConsoleServer(logger *zap.Logger, startupLogger *zap.Logger, db *sql.DB, config Config, tracker Tracker, router MessageRouter, streamManager StreamManager, sessionCache SessionCache, consoleSessionCache SessionCache, loginAttemptCache LoginAttemptCache, statusRegistry *StatusRegistry, statusHandler StatusHandler, runtimeInfo *RuntimeInfo, matchRegistry MatchRegistry, configWarnings map[string]string, serverVersion string, leaderboardCache LeaderboardCache, leaderboardRankCache LeaderboardRankCache, api *ApiServer, cookie string) *ConsoleServer {
		loginAttemptCache:    loginAttemptCache,
	"github.com/gofrs/uuid"
	"google.golang.org/protobuf/types/known/emptypb"
	ip, _ := extractClientAddressFromContext(s.logger, ctx)
	if !s.loginAttemptCache.Allow(in.Username, ip) {
		return nil, status.Error(codes.ResourceExhausted, "Try again later.")
	}

		} else {
			if lockout, until := s.loginAttemptCache.Add(s.config.GetConsole().Username, ip); lockout != LockoutTypeNone {
				switch lockout {
				case LockoutTypeAccount:
					s.logger.Info(fmt.Sprintf("Console admin account locked until %v.", until))
				case LockoutTypeIp:
					s.logger.Info(fmt.Sprintf("Console admin IP locked until %v.", until))
				}
			}
			return nil, status.Error(codes.Unauthenticated, "Invalid credentials.")
		id, uname, email, role, err = s.lookupConsoleUser(ctx, in.Username, in.Password, ip)
	s.loginAttemptCache.Reset(uname)


func (s *ConsoleServer) lookupConsoleUser(ctx context.Context, unameOrEmail, password, ip string) (id uuid.UUID, uname string, email string, role console.UserRole, err error) {
			if lockout, until := s.loginAttemptCache.Add("", ip); lockout == LockoutTypeIp {
				s.logger.Info(fmt.Sprintf("Console user IP locked until %v.", until))
			}
			err = status.Error(codes.Unauthenticated, "Invalid credentials.")
	// Check lockout again as the login attempt may have been through email.
	if !s.loginAttemptCache.Allow(uname, ip) {
		err = status.Error(codes.ResourceExhausted, "Try again later.")
		return
	}

		if lockout, until := s.loginAttemptCache.Add(uname, ip); lockout != LockoutTypeNone {
			switch lockout {
			case LockoutTypeAccount:
				s.logger.Info(fmt.Sprintf("Console user account locked until %v.", until))
			case LockoutTypeIp:
				s.logger.Info(fmt.Sprintf("Console user IP locked until %v.", until))
			}
		}
// Copyright 2022 The Nakama Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package server

import (
	"context"
	"sync"
	"time"
)

type LockoutType uint8

const (
	LockoutTypeNone LockoutType = iota
	LockoutTypeAccount
	LockoutTypeIp
)

const (
	maxAttemptsAccount   = 5
	lockoutPeriodAccount = time.Minute * 1

	maxAttemptsIp   = 10
	lockoutPeriodIp = time.Minute * 10
)

type LoginAttemptCache interface {
	Stop()
	// Allow checks whether account or IP is locked out or should be allowed to attempt to authenticate.
	Allow(account, ip string) bool
	// Add a failed attempt and return current lockout status.
	Add(account, ip string) (LockoutType, time.Time)
	// Reset account attempts on successful login.
	Reset(account string)
}

type lockoutStatus struct {
	lockedUntil time.Time
	attempts    []time.Time
}

func (ls *lockoutStatus) trim(now time.Time, retentionPeriod time.Duration) bool {
	if ls.lockedUntil.Before(now) {
		ls.lockedUntil = time.Time{}
	}
	for i := len(ls.attempts) - 1; i >= 0; i-- {
		if now.Sub(ls.attempts[i]) >= retentionPeriod {
			ls.attempts = ls.attempts[i+1:]
			break
		}
	}

	return ls.lockedUntil.IsZero() && len(ls.attempts) == 0
}

type LocalLoginAttemptCache struct {
	sync.RWMutex
	ctx         context.Context
	ctxCancelFn context.CancelFunc

	accountCache map[string]*lockoutStatus
	ipCache      map[string]*lockoutStatus
}

func NewLocalLoginAttemptCache() LoginAttemptCache {
	ctx, ctxCancelFn := context.WithCancel(context.Background())

	c := &LocalLoginAttemptCache{
		accountCache: make(map[string]*lockoutStatus),
		ipCache:      make(map[string]*lockoutStatus),

		ctx:         ctx,
		ctxCancelFn: ctxCancelFn,
	}

	go func() {
		ticker := time.NewTicker(10 * time.Minute)
		for {
			select {
			case <-c.ctx.Done():
				ticker.Stop()
				return
			case t := <-ticker.C:
				now := t.UTC()
				c.Lock()
				for account, status := range c.accountCache {
					if status.trim(now, lockoutPeriodAccount) {
						delete(c.accountCache, account)
					}
				}
				for ip, status := range c.ipCache {
					if status.trim(now, lockoutPeriodIp) {
						delete(c.ipCache, ip)
					}
				}
				c.Unlock()
			}
		}
	}()

	return c
}

func (c *LocalLoginAttemptCache) Stop() {
	c.ctxCancelFn()
}

func (c *LocalLoginAttemptCache) Allow(account, ip string) bool {
	now := time.Now().UTC()
	c.RLock()
	defer c.RUnlock()
	if status, found := c.accountCache[account]; found && !status.lockedUntil.IsZero() && status.lockedUntil.After(now) {
		return false
	}
	if status, found := c.ipCache[ip]; found && !status.lockedUntil.IsZero() && status.lockedUntil.After(now) {
		return false
	}
	return true
}

func (c *LocalLoginAttemptCache) Reset(account string) {
	c.Lock()
	delete(c.accountCache, account)
	c.Unlock()
}

func (c *LocalLoginAttemptCache) Add(account, ip string) (LockoutType, time.Time) {
	now := time.Now().UTC()
	var lockoutType LockoutType
	var lockedUntil time.Time
	c.Lock()
	defer c.Unlock()
	if account != "" {
		status, found := c.accountCache[account]
		if !found {
			status = &lockoutStatus{}
			c.accountCache[account] = status
		}
		status.attempts = append(status.attempts, now)
		_ = status.trim(now, lockoutPeriodAccount)
		if len(status.attempts) >= maxAttemptsAccount {
			status.lockedUntil = now.Add(lockoutPeriodAccount)
			lockedUntil = status.lockedUntil
			lockoutType = LockoutTypeAccount
		}
	}
	if ip != "" {
		status, found := c.ipCache[ip]
		if !found {
			status = &lockoutStatus{}
			c.ipCache[ip] = status
		}
		status.attempts = append(status.attempts, now)
		_ = status.trim(now, lockoutPeriodIp)
		if len(status.attempts) >= maxAttemptsIp {
			status.lockedUntil = now.Add(lockoutPeriodIp)
			lockedUntil = status.lockedUntil
			lockoutType = LockoutTypeIp
		}
	}
	return lockoutType, lockedUntil
}