Aviatrix Controller Password Reset Brute Force Vulnerability

A vulnerability exists in Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0, where rate limiting is not enforced on password reset requests. This oversight allows attackers to brute force the 6-digit password reset PIN, with approximately 888,888 possible combinations. The lack of effective token management creates a window of opportunity for account takeover within 15 minutes of initiating a password reset.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, including administrative accounts, on the Aviatrix Controller.

Reproduction

To reproduce this vulnerability, initiate a password reset request for an account. Then, use a tool to automate the process of guessing the 6-digit PIN by sending repeated password reset requests. The absence of rate limiting will enable the brute force attack to succeed within the 15-minute validity period of the reset token.

Remediation

Users can update to Aviatrix Controller versions 8.0.0, 7.2.5090, or 7.1.4208 to address this vulnerability.