Shiori Brute Force Authentication Bypass Vulnerability

A vulnerability exists in Shiori versions through 1.7.4 due to the absence of rate limiting on the login page. This flaw enables attackers to execute brute force attacks, bypassing authentication altogether. The issue has been reported by a user who successfully performed a brute force attack using Burp Suite's Intruder tool.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts through successful brute force login attempts.

Reproduction

To reproduce this vulnerability, navigate to the login page of Shiori. Capture the login POST request using Burp Suite, then use the Intruder tool to automate a brute force attack on the password field.

Remediation

Users are advised to update to Shiori version 1.8.0 or later, where this vulnerability has been addressed.