OpenSourceOSPOS Login Pre-Auth Rate Limiting Bypass and ReCAPTCHA Timing Oracle

Vulnerability Overview Vulnerability Name: OpenSourcePOS Login Endpoint — Missing Authentication Rate-Limiting / Account-Lockout, Compounded by Post-Password CAPTCHA Validation Ordering Vulnerability Type: Primary: CWE-307 — Improper Restriction of Excessive Authentication Attempts (No rate limiting, no account lockout, no IP throttling) Secondary: CWE-204 / CWE-303 — Observable Response Differences and Misimplementation of Authentication Algorithm. The Google reCAPTCHA check is executed after password validation; therefore, failed password attempts never consume a CAPTCHA, and differing error responses ( vs ) create a credential validity oracle. Affected Product: Product: Open Source Point of Sale (OpenSourcePOS / OSPOS) Vendor: opensourcepos Affected Versions: All versions up to 3.4.2 (as of this writing) Component: Authentication/Login Subsystem CVSS 3.1: Base Score 5.3 (Medium) Description: OpenSourcePOS authenticates users via the controller action, which applies a custom validation rule ( ) to submitted credentials. The application implements no protection against repeated failed authentication attempts: there is no failure attempt counter, no temporary or permanent account lockout, and no per-IP or per-account rate limiting. An attacker can submit an unlimited number of username/password combinations at machine speed. The only optional mitigation is Google reCAPTCHA, which is disabled by default (the setting is missing from the default configuration file). In a default deployment, the login endpoint has neither reCAPTCHA nor rate limiting, and is excluded from CSRF protection, meaning credential guessing requests do not require a CSRF token. Even if the administrator enables reCAPTCHA, the validation logic in verifies the password before the CAPTCHA. When the password is incorrect, the function returns immediately, and the CAPTCHA branch is never reached. Consequently: 1. Incorrect password attempts never consume or require a valid CAPTCHA token, meaning CAPTCHA does not throttle guessing. 2. The server returns for incorrect passwords but for correct passwords (even if the token is missing). This observable response difference constitutes a credential validity oracle: an attacker can determine the correct password without solving the CAPTCHA by observing which error is returned. The ultimate effect is that an attacker can enumerate valid credentials offline. With CAPTCHA disabled (the default), a correct guess additionally grants a direct authenticated session (HTTP 302 redirect to ). Impact Scope Attack Vector (AV): Network (N) — The login endpoint is remotely accessible via HTTP. Attack Complexity (AC): Low (L) — No special conditions; simple repeated POST requests. Privileges Required (PR): None (N) — Pre-authentication. User Interaction (UI): None (N) — Fully automated. Scope (S): Unchanged (U) — Remains within the application. Confidentiality (C): Low (L) — Enables unauthorized credential guessing and credential validity oracle; full account compromise depends on password strength, hence low rather than high. Integrity (I): None (N) — No direct data modification from the vulnerability. Availability (A): None (N) — No direct availability impact. Remediation 1. Add Brute-Force Protection (Primary Fix): Implement a failure attempt counter with temporary account and/or per-IP account lockout and exponential backoff (e.g., using CodeIgniter4 Throttler) around the login endpoint validation. 2. Validate CAPTCHA Before Password: When is true, verify the reCAPTCHA token first, so incorrect password attempts must pass through CAPTCHA, enabling CAPTCHA protection to prevent the credential validity oracle. 3. Return Unified, Opaque Errors: Use the same generic "Login failed" message and status code for both incorrect password and missing/invalid CAPTCHA scenarios to remove the credential validity oracle. 4. Re-enable CSRF Protection for /login: Remove from the exception list or enforce Origin/SameSite checks. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

OpenSourceOSPOS Login Pre-Auth Rate Limiting Bypass and ReCAPTCHA Timing Oracle

More from this source