CVE-2022-4006 (published 2022-11-15T22:15Z)

A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The name of the patch is d394ba39a7bfeb31eda797b6195fd90ef74b2e75. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213716.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-307
cwe_name: Improper Restriction of Excessive Authentication Attempts
description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/wbce/wbce_cms
commit_details: repo_url: https://github.com/wbce/wbce_cms
author: Martin Hecht
author_date: 2022-11-13 22:15:25+01:00
msg: fix for #524

usually, ip addresses with multiple failed login attempts should be
blocked. An attacker could bypass this by sending an X-forwarded-for
header and change that IP with each attempt. Since REMMOTE_ADDR
is harder to fake we should first check that one and only if that one is
not set for some reason, rely on other variables.
repository: repo_url: https://github.com/wbce/wbce_cms
repo_name: WBCE/WBCE_CMS
description: Core package of WBCE CMS. This package includes the core and the default addons. Visit https://wbce.org (DE) or https://wbce-cms.org (EN) to learn more or to join the WBCE CMS community. 
repo_language: PHP
owner: wbce
file_changes: filename: class.login.php
change_type: ModificationType.MODIFY
diff: @@ -410,8 +410,13 @@ class Login extends Admin
      */
     private function get_client_ip()
     {
-        $ipaddress = '';
-        if (isset($_SERVER['HTTP_CLIENT_IP'])) {
+	$ipaddress = '';
+	// for security reasons first check remote_addr which is more difficult to fake:
+	if (isset($_SERVER['REMOTE_ADDR'])) {
+	    $ipaddress = $this->get_server('REMOTE_ADDR');
+	} elseif (getenv('REMOTE_ADDR')) {
+	    $ipaddress = getenv('REMOTE_ADDR');
+	} elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
             $ipaddress = $this->get_server('HTTP_CLIENT_IP');
         } elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
             $ipaddress = $this->get_server('HTTP_X_FORWARDED_FOR');
@@ -421,8 +426,6 @@ class Login extends Admin
             $ipaddress = $this->get_server('HTTP_FORWARDED_FOR');
         } elseif (isset($_SERVER['HTTP_FORWARDED'])) {
             $ipaddress = $this->get_server('HTTP_FORWARDED');
-        } elseif (isset($_SERVER['REMOTE_ADDR'])) {
-            $ipaddress = $this->get_server('REMOTE_ADDR');
         } elseif (getenv('HTTP_CLIENT_IP')) {
             $ipaddress = getenv('HTTP_CLIENT_IP');
         } elseif (getenv('HTTP_X_FORWARDED_FOR')) {
@@ -433,8 +436,6 @@ class Login extends Admin
             $ipaddress = getenv('HTTP_FORWARDED_FOR');
         } elseif (getenv('HTTP_FORWARDED')) {
             $ipaddress = getenv('HTTP_FORWARDED');
-        } elseif (getenv('REMOTE_ADDR')) {
-            $ipaddress = getenv('REMOTE_ADDR');
         } else {
             $ipaddress = 'UNKNOWN';
         }

programming_language: PHP