Rate Limiting Bypass Affecting express-brute package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-EXPRESSBRUTE-174457
- published 21 Apr 2019
- disclosed 18 Apr 2019
- credit subhamAggarwal
How to fix?
There is no fixed version for express-brute.
Overview
express-brute is a brute-force protection middleware for express routes that rate-limits incoming requests, increasing the delay with each request in a fibonacci-like sequence.
Affected versions of this package are vulnerable to Rate Limiting Bypass due to incorrectly counting the number of requests sent, this allows an attacker to bypass the rate-limiting mechanism.
References
CVSS Scores
version 3.1