Description
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
phoenixthrush AniWorld Downloader
Default version status: unaffected
0 to < 5.3.0affected
pkg:pypi/aniworldReferences
- https://github.com/phoenixthrush/AniWorld-Downloader/issues/334 ↗
- https://github.com/phoenixthrush/AniWorld-Downloader/commit/3c070bd10665377308a3092e11933681c18a5fd1 ↗
- https://github.com/phoenixthrush/AniWorld-Downloader/releases/tag/v.5.3.0 ↗
- https://hackmd.io/@haind/aniworld-login-brute-force ↗
- https://github.com/phoenixthrush/AniWorld-Downloader/blob/bb13599d17937fdb4df2df699024bc233f0656f2/src/aniworld/web/auth.py#L239-L256 ↗
- https://www.vulncheck.com/advisories/aniworld-downloader-before-5.3.0-webui-login-brute-force-via-login ↗