Anubis Bot Protection Bypass Vulnerability

A vulnerability in Anubis, a tool designed to protect against AI scrapers, allows attackers to bypass bot protection mechanisms. This issue arises from the server accepting client-specified difficulty values for proof-of-work challenges, which can be manipulated to ease the scraping process. The vulnerability is present in versions prior to v1.11.0-37-gd98d70a.

Impact

Exploitation of this vulnerability allows sophisticated attackers to bypass bot protection on targeted websites, potentially leading to increased scraping activities.

Reproduction

To reproduce this vulnerability, request a proof-of-work challenge from a server using Anubis. When the challenge is issued, specify a nonce of your choice and set the difficulty to zero. The server will accept this manipulated challenge, effectively bypassing the bot protection.

Remediation

Users should upgrade to Anubis version v1.11.0-37-gd98d70a or later.