Executive Summary

The vulnerability exists in HomeBox versions prior to 0.24.0 in the authentication rate limiter mechanism. The rate limiter tracks failed login attempts based on the client IP address, which it determines by reading headers such as X-Real-IP and X-Forwarded-For, or the TCP connection address. However, these headers are read unconditionally without verifying their trustworthiness. An attacker connecting directly to HomeBox can forge the X-Real-IP header, effectively bypassing the rate limiter by appearing as a new client IP on each request. Additionally, the TrustProxy configuration option intended to control this behavior was never actually used by the middleware or rate limiter. The middleware also overwrites the remote address with the forged header value before handling the request, enabling the attacker to evade rate limiting.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to bypass the authentication rate limiting by forging client IP addresses. As a result, an attacker can perform a large number of failed login attempts without being blocked or slowed down by the rate limiter. This can lead to brute force attacks on user accounts, increasing the risk of unauthorized access. The vulnerability impacts the confidentiality and integrity of the system by enabling attackers to potentially compromise user credentials.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade HomeBox to version 0.24.0 or later, where the issue with the authentication rate limiter and the TrustProxy option has been fixed.

Useful 0 Not Useful 0