Rate Limiting Bypass in ZenML via X-Forwarded-For Header

Executive Summary

This vulnerability affects zenml versions 0.57.0 through 0.94.2. It allows attackers to bypass rate-limiting on login and password-change endpoints by manipulating the X-Forwarded-For header. When Uvicorn runs with proxy headers enabled, the rate limiter uses the header value as the client IP, letting attackers rotate it to avoid throttling and perform credential guessing attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your ZenML server is running with Uvicorn configured with `--proxy-headers --forwarded-allow-ips *`. Inspect logs for repeated login attempts or password changes from the same source IP. Verify if rate-limiting is bypassed by monitoring failed login attempts that should have been throttled.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to repeatedly guess passwords without rate limits, potentially gaining unauthorized access to accounts. This increases the risk of account takeovers and data breaches if weak or reused passwords are used.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling brute-force attacks on authentication endpoints. Unlimited login attempts may allow attackers to guess credentials, potentially leading to unauthorized access to personal or sensitive health data. GDPR requires adequate security for personal data, while HIPAA mandates strong access controls for protected health information. The lack of rate-limiting violates these requirements by exposing systems to credential stuffing attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Update ZenML to a version that includes the fix (commit 8a2214b or later). Disable the vulnerable Uvicorn proxy headers configuration. Ensure rate-limiting is enforced using the direct client host from the request object instead of forwarded headers.

Useful 0 Not Useful 0