HTTP Basic Auth Credential Brute Force in Service

Executive Summary

This vulnerability involves HTTP basic authentication lacking retry limits or backoff mechanisms. This allows attackers to repeatedly attempt password guesses without delay, making brute-force attacks feasible due to the limited keyspace.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized access to the system by guessing the default password. This could lead to data breaches, unauthorized control, or further network compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows brute-force attacks on HTTP basic auth due to no retry limit or backoff, combined with a default service password. This could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Disable HTTP basic auth if not required. If authentication is necessary, enforce strong passwords and implement retry limits or account lockouts to prevent brute force attacks.

Useful 0 Not Useful 0