Implement login throttling and lockout mechanism to mitigate brute-force attacks on the authentication endpoint.

[zeropath-ai-dev]

Summary

• The Vulnerability Description:
  The login endpoint did not limit failed authentication attempts, failing to increment a failure counter or trigger account lockout after repeated invalid logins, and didn’t use delay techniques. This allowed attackers to rapidly brute-force credentials without restriction.

• This Fix:
  We now track failed login attempts per email, block login on repeated failures (HTTP 429 on 5+ attempts), and reset counters upon a successful authentication, effectively rate-limiting brute-force attempts.

• The Cause of the Issue:
  The code lacked logic to monitor and limit consecutive failed login attempts, leaving the authentication process vulnerable to unlimited, automated brute-force attacks with no mitigation.

• The Patch Implementation:
  A server-side loginFailures record counts login failures by email. Users with 5 or more failed attempts receive a 429 response, counters reset on success, and failed attempts are incremented after each unsuccessful login.

Vulnerability Details

• Vulnerability Class: Natural Language Rule Violation
• Severity: 9.3
• Affected File: data/static/codefixes/loginAdminChallenge_1.ts
• Vulnerable Lines: 16-41

Code Snippets

diff --git a/data/static/codefixes/loginAdminChallenge_1.ts b/data/static/codefixes/loginAdminChallenge_1.ts
index 9a7960f3e..53d0bdb60 100644
--- a/data/static/codefixes/loginAdminChallenge_1.ts
+++ b/data/static/codefixes/loginAdminChallenge_1.ts
@@ -1,7 +1,11 @@
 import {BasketModel} from "../../../models/basket";
 
 module.exports = function login () {
+  // Track failed login attempts per email
+  const loginFailures: Record<string, number> = {}
   function afterLogin (user: { data: User, bid: number }, res: Response, next: NextFunction) {
+    // reset failures on successful login
+    delete loginFailures[user.data.email]
     BasketModel.findOrCreate({ where: { UserId: user.data.id } })
       .then(([basket]: [BasketModel, boolean]) => {
         const token = security.authorize(user)
@@ -14,6 +18,11 @@ module.exports = function login () {
   }
 
   return (req: Request, res: Response, next: NextFunction) => {
+    const email = req.body.email || ''
+    // Throttle login attempts to prevent brute-force
+    if (loginFailures[email] >= 5) {
+      return res.status(429).send(res.__('Too many login attempts. Try again later.'))
+    }
     if (req.body.email.match(/.*['-;].*/) || req.body.password.match(/.*['-;].*/)) {
       res.status(451).send(res.__('SQL Injection detected.'))
     }
@@ -21,6 +30,8 @@ module.exports = function login () {
       .then((authenticatedUser) => {
         const user = utils.queryResultToJson(authenticatedUser)
         if (user.data?.id && user.data.totpSecret !== '') {
+          // reset failures on valid password
+          delete loginFailures[email]
           res.status(401).json({
             status: 'totp_token_required',
             data: {
@@ -33,9 +44,10 @@ module.exports = function login () {
         } else if (user.data?.id) {
           afterLogin(user, res, next)
         } else {
+          loginFailures[email] = (loginFailures[email] || 0) + 1
           res.status(401).send(res.__('Invalid email or password.'))
         }
       }).catch((error: Error) => {
         next(error)
       })
-  }
\ No newline at end of file
+  }

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai-dev bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai-dev!

To request modifications, please post a comment beginning with @zeropath-ai-dev and specify the changes required.

@zeropath-ai-dev will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_natural_language_rule_violation_1755147262753553

# if vscode is installed run (or use your favorite editor / IDE):
code data/static/codefixes/loginAdminChallenge_1.ts

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_natural_language_rule_violation_1755147262753553