Muhammad FaqihApplication security · Penetration testing
Test case 10 / 19FAIL

Unrestricted Resource Consumption - Authentication - Login Rate Limiting

Lab environment — not a production system

Screenshots and raw traffic are not translated; text within them may be in another language.

crAPI/Evidence/[FAIL] Unrestricted Resource Consumption - Authentication - Login Rate Limiting

01 — Notes

Test notes

Vulnerability

[FAIL] Unrestricted Resource Consumption - Authentication - Login Rate Limiting

Description

The crAPI login endpoint applies neither rate limiting nor account lockout. Repeated failed login attempts are not limited, enabling brute force/credential stuffing and unbounded consumption of server resources.

Impact

Availability: the server can be flooded with authentication requests without restriction. Confidentiality: enables credential brute force to take over accounts.

CWE

CWE-307: Improper Restriction of Excessive Authentication Attempts (CWE-770: Allocation of Resources Without Limits)

OWASP

API4:2023 - Unrestricted Resource Consumption

Scenario

Normal: a single failed login -> 401. Exploitation: 20 consecutive attempts -> all 401 with no 429/lockout, proving there is no restriction.

Endpoint

POST http://127.0.0.1:8888/identity/api/auth/login

Affected feature

Login Authentication (crapi-identity)

Remediation

- Apply per-account/IP rate limiting and progressive account lockout. - Add CAPTCHA/anti-automation and anomaly detection. - Limit concurrency/requests per client.

Proof of concept

1) (Screenshot 1) NORMAL: POST /identity/api/auth/login with a wrong password -> 401. 2) (Screenshot 2) EXPLOITATION: send 20 consecutive login attempts -> all 401 with no HTTP 429/lockout, proving there is no rate limiting.
View source note (English)
Vulnerability: [FAIL] Unrestricted Resource Consumption - Authentication - Login Rate Limiting

Description:
The crAPI login endpoint applies neither rate limiting nor account lockout. Repeated failed login attempts are not limited, enabling brute force/credential stuffing and unbounded consumption of server resources.

Impact:
Availability: the server can be flooded with authentication requests without restriction. Confidentiality: enables credential brute force to take over accounts.

CWE:
CWE-307: Improper Restriction of Excessive Authentication Attempts (CWE-770: Allocation of Resources Without Limits)

OWASP:
API4:2023 - Unrestricted Resource Consumption

Scenario:
Normal: a single failed login -> 401. Exploitation: 20 consecutive attempts -> all 401 with no 429/lockout, proving there is no restriction.

Endpoint:
POST http://127.0.0.1:8888/identity/api/auth/login

Affected Feature:
Login Authentication (crapi-identity)

Remediation:
- Apply per-account/IP rate limiting and progressive account lockout.
- Add CAPTCHA/anti-automation and anomaly detection.
- Limit concurrency/requests per client.

POC:
1) (Screenshot 1) NORMAL: POST /identity/api/auth/login with a wrong password -> 401.
2) (Screenshot 2) EXPLOITATION: send 20 consecutive login attempts -> all 401 with no HTTP 429/lockout, proving there is no rate limiting.

02 — Screenshots

Screenshots (2)

01 / Normal: one failed login

Normal flow: one login attempt with an incorrect password returns 401.

02 / Observation: 20 login attempts, no rate limit

Impact: the 20 login attempts encounter no rate limit. This leaves the login exposed to credential brute-force, credential stuffing and unrestricted resource consumption, putting availability and confidentiality at risk. The capture does not demonstrate account takeover or denial of service.

03 — Requests and responses

HTTP captures

Some credential values are masked in this public HTML view. This does not mean every sensitive value or linked file has been redacted.

CAPTURE 01 / 1Normal: one failed login
HTTP request
POST /identity/api/auth/login HTTP/1.1
Host: 127.0.0.1:8888
Content-Type: application/json

{"email":"[REDACTED-EMAIL]","password":"[REDACTED-LAB-VALUE]"}
HTTP response
HTTP/1.1 401
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 76

{
  "token": null,
  "type": "",
  "message": "Invalid Credentials",
  "mfaRequired": false
}

Normal flow: one login attempt with an incorrect password returns 401.

CAPTURE 02 / 2Observation: 20 login attempts, no rate limit
HTTP request
POST /identity/api/auth/login HTTP/1.1
Host: 127.0.0.1:8888
Content-Type: application/json

{"email":"[REDACTED-EMAIL]","password":"[REDACTED-LAB-VALUE]"}
# 20 percobaan login BERUNTUN -> semua 401, TIDAK ada HTTP 429/lockout
HTTP response
Status 20 percobaan beruntun:
401 401 401 401 401 401 401 401 401 401 401 401 401 401 401 401 401 401 401 401

=> tidak ada 429/lockout pada percobaan mana pun.

Impact: the 20 login attempts encounter no rate limit. This leaves the login exposed to credential brute-force, credential stuffing and unrestricted resource consumption, putting availability and confidentiality at risk. The capture does not demonstrate account takeover or denial of service.