Implement login attempt throttling and account lockout to mitigate brute-force attacks on authentication endpoint.

[zeropath-ai-dev]

Summary

• The Vulnerability Description:
  The authentication endpoint did not track failed login attempts, lock accounts after repeated failures, or introduce delays, allowing unlimited rapid login attempts and making the application vulnerable to brute-force attacks.

• This Fix:
  The fix adds logic to count failed login attempts per IP, enforce an account lockout after five consecutive failures for 15 minutes, and resets the counter after the lockout period, protecting against brute-force and credential stuffing.

• The Cause of the Issue:
  The original code immediately returned an HTTP 401 error for failed logins, with no throttling, lockout, or delay mechanism, leaving the system exposed to automated, repeated login attempts.

• The Patch Implementation:
  The patch introduces a failedAttempts counter and timestamps, checks for lockout status before processing logins, resets counters after the lockout expires, and clears attempt tracking for successful logins—effectively mitigating brute-force risks.

Vulnerability Details

• Vulnerability Class: Natural Language Rule Violation
• Severity: 6.9
• Affected File: data/static/codefixes/loginJimChallenge_2.ts
• Vulnerable Lines: 16-37

Code Snippets

diff --git a/data/static/codefixes/loginJimChallenge_2.ts b/data/static/codefixes/loginJimChallenge_2.ts
index 4b9d3e643..65622c61c 100644
--- a/data/static/codefixes/loginJimChallenge_2.ts
+++ b/data/static/codefixes/loginJimChallenge_2.ts
@@ -1,6 +1,9 @@
 import {BasketModel} from "../../../models/basket";
 
 module.exports = function login () {
+  const loginAttempts: { [key: string]: { count: number; firstAttemptTime: number } } = {};
+  const MAX_LOGIN_ATTEMPTS = 5;
+  const LOCKOUT_DURATION_MS = 15 * 60 * 1000;
   function afterLogin (user: { data: User, bid: number }, res: Response, next: NextFunction) {
     BasketModel.findOrCreate({ where: { UserId: user.data.id } })
       .then(([basket]: [BasketModel, boolean]) => {
@@ -14,10 +17,21 @@ module.exports = function login () {
   }
 
   return (req: Request, res: Response, next: NextFunction) => {
+    const key = req.ip;
+    const state = loginAttempts[key] || { count: 0, firstAttemptTime: Date.now() };
+    if (state.count >= MAX_LOGIN_ATTEMPTS && (Date.now() - state.firstAttemptTime) < LOCKOUT_DURATION_MS) {
+      return res.status(429).send(res.__('Too many login attempts. Please try again later.'));
+    }
+    if ((Date.now() - state.firstAttemptTime) >= LOCKOUT_DURATION_MS) {
+      state.count = 0;
+      state.firstAttemptTime = Date.now();
+    }
+    loginAttempts[key] = state;
     models.sequelize.query(`SELECT * FROM Users WHERE email = '${req.body.email || ''}' AND password = '${security.hash(req.body.password || '')}' AND deletedAt IS NULL`, { model: models.User, plain: false })
       .then((authenticatedUser) => {
         const user = utils.queryResultToJson(authenticatedUser)
         if (user.data?.id && user.data.totpSecret !== '') {
+          delete loginAttempts[key];
           res.status(401).json({
             status: 'totp_token_required',
             data: {
@@ -28,11 +42,15 @@ module.exports = function login () {
             }
           })
         } else if (user.data?.id) {
+          delete loginAttempts[key];
           afterLogin(user, res, next)
         } else {
+          const failState = loginAttempts[key] || { count: 0, firstAttemptTime: Date.now() };
+          failState.count++;
+          loginAttempts[key] = failState;
           res.status(401).send(res.__('Invalid email or password.'))
         }
       }).catch((error: Error) => {
         next(error)
       })
-  }
\ No newline at end of file
+  }

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai-dev bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai-dev!

To request modifications, please post a comment beginning with @zeropath-ai-dev and specify the changes required.

@zeropath-ai-dev will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_natural_language_rule_violation_1755147185948770

# if vscode is installed run (or use your favorite editor / IDE):
code data/static/codefixes/loginJimChallenge_2.ts

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_natural_language_rule_violation_1755147185948770