CVE-2022-3993 (C#, published 2022-11-14T18:15Z)
Description: value: Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.






Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/kareadita/kavita
Files changed:
API/Controllers/AccountController.cs
Commit message: Security Patches (#1624)

* Fixed an issue where migrate-email could be called when an admin already existed

* When logging in, ensure there is no bias towards username or password when rejecting

* Cleaned up some messaging around anonymous apis to ensure there are no attack vectors.

Vulnerable code:
        if (user == null) return Unauthorized("Invalid username");
            return Unauthorized(result.IsNotAllowed ? "You must confirm your email first" : "Your credentials are not correct.");
            return BadRequest("The email does not match the registered email");
        if (!await ConfirmEmailToken(dto.Token, user)) return BadRequest("Invalid Email Token");
            return BadRequest("Invalid Email Token");
        if (!await ConfirmEmailToken(dto.Token, user)) return BadRequest("Invalid Email Token");

                return BadRequest("Invalid Details");
            if (!result) return BadRequest("Unable to reset password, your email token is not correct.");
        if (user == null) return BadRequest("This email is not on system");
        if (!await ConfirmEmailToken(dto.Token, user)) return BadRequest("Invalid Email Token");

Fixed code:
        if (user == null) return Unauthorized("Your credentials are not correct");
            return Unauthorized(result.IsNotAllowed ? "You must confirm your email first" : "Your credentials are not correct");
    /// <summary>
    /// Last step in authentication flow, confirms the email token for email
    /// </summary>
    /// <param name="dto"></param>
    /// <returns></returns>
            _logger.LogInformation("confirm-email failed from invalid registered email: {Email}", dto.Email);
            return BadRequest("Invalid email confirmation");
        if (!await ConfirmEmailToken(dto.Token, user))
        {
            _logger.LogInformation("confirm-email failed from invalid token: {Token}", dto.Token);
            return BadRequest("Invalid email confirmation");
        }
            _logger.LogInformation("confirm-email failed from invalid registered email: {Email}", dto.Email);
            return BadRequest("Invalid email confirmation");
        if (!await ConfirmEmailToken(dto.Token, user))
        {
            _logger.LogInformation("confirm-email failed from invalid token: {Token}", dto.Token);
            return BadRequest("Invalid email confirmation");
        }
                return BadRequest("Invalid credentials");
            if (!result)
            {
                _logger.LogInformation("Unable to reset password, your email token is not correct: {@Dto}", dto);
                return BadRequest("Invalid credentials");
            }
        if (user == null) return BadRequest("Invalid credentials");
        if (!await ConfirmEmailToken(dto.Token, user))
        {
            _logger.LogInformation("confirm-migration-email email token is invalid");
            return BadRequest("Invalid credentials");
        }
        // If there is an admin account already, return
        var users = await _unitOfWork.UserRepository.GetAdminUsersAsync();
        if (users.Any()) return BadRequest("Admin already exists");