CVE-2023-1665
📋 TL;DR
This vulnerability allows attackers to perform unlimited authentication attempts against Twake instances, enabling brute-force attacks to guess user credentials. It affects all Twake deployments prior to version 0.0.0 that haven't implemented proper rate limiting. This puts all user accounts at risk of compromise.
💻 Affected Systems
- Twake
📦 What is this software?
Twake by Linagora
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of all user accounts through brute-force attacks, leading to data theft, unauthorized access to sensitive information, and potential lateral movement within the organization.
Likely Case
Targeted brute-force attacks against specific user accounts, particularly administrators or users with weak passwords, resulting in unauthorized access to sensitive data and systems.
If Mitigated
Limited impact with proper rate limiting and strong password policies in place, though still vulnerable to sophisticated attacks if not patched.
🎯 Exploit Status
The exploit requires no authentication and can be automated with simple scripts. Public proof-of-concept exists in the bounty report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.0 or later
Vendor Advisory: https://github.com/linagora/twake/commit/599f397561a771251dfc7cafb8cecda5ab22b8b3
Restart Required: Yes
Instructions:
1. Update Twake to version 0.0.0 or later. 2. Apply the patch from commit 599f397561a771251dfc7cafb8cecda5ab22b8b3. 3. Restart the Twake service. 4. Verify rate limiting is now enforced.
🔧 Temporary Workarounds
Implement Web Application Firewall (WAF) Rate Limiting
allConfigure WAF rules to limit authentication attempts per IP address
# Example for nginx: limit_req_zone $binary_remote_addr zone=auth:10m rate=5r/m;
# Then apply to auth endpoints
Enable Strong Password Policies
allEnforce complex passwords and regular password changes to reduce brute-force success
# Configure in Twake admin panel or via environment variables
🧯 If You Can't Patch
- Implement network-level rate limiting at firewall or load balancer
- Enable multi-factor authentication for all users
🔍 How to Verify
Check if Vulnerable:
Attempt multiple failed logins from the same IP address and verify if authentication continues to be allowed beyond reasonable limits (e.g., more than 10 attempts per minute).Check Version:
Check Twake version in admin panel or via API endpointVerify Fix Applied:
After patching, attempt multiple failed logins and verify that subsequent attempts are blocked or delayed.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from same IP address
- Unusual authentication patterns
- Account lockout events if implemented
Network Indicators:
- High volume of POST requests to authentication endpoints
- Traffic patterns showing repeated login attempts
SIEM Query:
source="twake" AND (event="authentication_failed" OR event="login_failed") | stats count by src_ip | where count > 10