802709 - wiki.mozilla.org Password policy [brute force]

Status: RESOLVED WONTFIX

(Websites :: wiki.mozilla.org, defect)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I have found that the https://wiki.mozilla.org login page Url https://wiki.mozilla.org/index.php?title=Special:UserLogin&returnto=Main%20Page is vulnerable to bruteforce attacks as there is no account lockout policy or captcha implementation as when attacker submits the wrong password in the password input field it prompts that we were unable to log you in and when the attacker submits the right password in the password input field while doing advance bruteforcing then there is no error message displayed as the attacker gets logged and redirected to the https://wiki.mozilla.org/User:Ajaysinghnegi page. That means that the attacker can successfully does the bruteforce attack(or password enumeration) as there is no captcha Implement or account lockput policy and this attack can be done manually or by creating a scripting in ruby or python languages.


Thanks & Regards!

Ajay Singh Negi.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Attachment: Screen shot 1

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Attachment: Screen shot 2

Comment 3

[Reed Loden [:reed]]

wiki.mozilla.org is just MediaWiki, so any type of password lockout policy would need to be implemented upstream. Also, wikimo has nothing secret or confidential on it, so even if somebody did get into an account, any disruption would be minimal and easily revertible. As such, going to mark this WONTFIX for now.

Thanks for the report!