CVE-2021-27188
📋 TL;DR
This vulnerability in Sovremennye Delovye Tekhnologii FX Aggregator terminal client allows attackers to cause a denial of service by making five invalid login attempts to a victim's account, resulting in account suspension for five hours. It affects users of the FX Aggregator terminal client version 1.
💻 Affected Systems
- Sovremennye Delovye Tekhnologii FX Aggregator terminal client
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Targeted denial of service attacks against specific user accounts, preventing legitimate users from accessing their trading accounts for extended periods during critical market conditions.
Likely Case
Accidental or malicious account lockouts causing temporary service disruption for individual users.
If Mitigated
Minimal impact with proper rate limiting and account lockout policies in place.
🎯 Exploit Status
Exploitation requires only five failed login attempts against any user account. Public proof-of-concept code is available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Check with vendor for updated versions or security advisories.
🔧 Temporary Workarounds
Implement Rate Limiting
allConfigure rate limiting on authentication attempts to prevent rapid failed login attempts.
Implementation depends on network infrastructure - configure rate limiting on firewall, load balancer, or application layer
Modify Account Lockout Policy
allChange account lockout duration from 5 hours to a shorter period or implement progressive delays.
Requires application configuration changes - consult application documentation
🧯 If You Can't Patch
- Implement network-level controls to limit authentication attempts per IP address
- Monitor for patterns of failed login attempts and implement alerting
🔍 How to Verify
Check if Vulnerable:
Test by making five consecutive failed login attempts to any user account and verify if account becomes suspended for five hours.Check Version:
Check application version through application interface or consult vendor documentationVerify Fix Applied:
After implementing controls, test that five failed login attempts no longer cause five-hour account suspension.📡 Detection & Monitoring
Log Indicators:
- Five consecutive failed login attempts for same user account within short time frame
- Account lockout/suspension events
Network Indicators:
- Multiple authentication requests from same source IP in rapid succession
- Pattern of failed login attempts
SIEM Query:
source="auth_logs" | where event="failed_login" | stats count by user, src_ip | where count >= 5🔗 References
- https://github.com/jet-pentest/CVE-2021-27188
- https://www.dnb.com/business-directory/company-profiles.pryaniki_ooo.13b676c626e38d534ff1a6a2a9fc7e6a.html
- https://github.com/jet-pentest/CVE-2021-27188
- https://www.dnb.com/business-directory/company-profiles.pryaniki_ooo.13b676c626e38d534ff1a6a2a9fc7e6a.html
