CVE-2022-31007 PoC — eLabFTW 安全漏洞

Source

Associated Vulnerability

Description

elabFTW < 4.1.0 - account lockout bypass and login brute force

Readme

Python automation of the following [write up](https://www.vicarius.io/blog/bypassing-account-lockout-on-elabftw-and-brute-force-login-cve-2022-31007) on an elabFTW account lockout bypass and login brute force that affects versions before 4.1.0.

Both scripts can be used against Proving Grounds Practice lab named Source, which is running a vulnerable version of elabFTW - a free and open source electronic lab notebook.

The account login requires an email address so a valid domain of any potential user needs to be known before brute forcing user names.

Once a valid account is found put that into the login brute force script. 

File Snapshot

 [4.0K]  /data/pocs/7cb6ee39e7d87c41e21fec90f16180959555a1db
├── [1.4K]  elabFTW-login-bruteforce.py
├── [1003]  elabFTW-username-bruteforce.py
└── [ 633]  README.md

0 directories, 3 files

Remarks