Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue.
The application uses Django REST Framework configured with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting mechanism (5 attempts per minute per IP address) works only for the HTML endpoint /accounts/login/ and does not cover API endpoints. An attacker can therefore direct HTTP requests with the Authorization: Basic header to any protected API endpoint, performing an unlimited number of password guessing attempts without risk of account lockout or slowdown.
An attacker knowing a username can conduct a rapid brute-force attack and take control of an account, gaining full access to data (C:H) and the ability to modify resources (I:H) without any server-side restrictions.
Tandoor Recipes should be updated to version 2.6.0, which contains a fix eliminating the vulnerability. Details are available in the manufacturer's references on GitHub.
Tandoor Recipes in versions earlier than 2.6.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NTandoor Recipes
APPTandoor< 2.6.0
Related vulnerabilities
Tandoor Recipes: SSTI w Jinja2 umożliwia RCE każdemu zalogowanemu użytkownikowi
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to ...
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to ...
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to ...
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versio...