CVE-2024-55008
📋 TL;DR
JATOS 3.9.4 contains an authentication DoS vulnerability where attackers can lock any user account indefinitely by submitting 3 failed login attempts per minute. This affects all JATOS users regardless of privileges since lockouts are account-based rather than IP-based. The vulnerability allows denial of service against legitimate users.
💻 Affected Systems
- JATOS
📦 What is this software?
Jatos by Jatos
⚠️ Risk & Real-World Impact
Worst Case
Critical users (administrators, researchers) are locked out during time-sensitive operations, disrupting research studies and system administration.
Likely Case
Regular users experience account lockouts preventing access to their studies and data, requiring manual intervention to unlock accounts.
If Mitigated
With proper monitoring and rate limiting, impact is limited to temporary inconvenience with quick detection and response.
🎯 Exploit Status
Exploitation requires no special tools - just repeated HTTP POST requests to login endpoint. Attackers need valid usernames but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.9.5 or later
Vendor Advisory: http://jatos.com
Restart Required: Yes
Instructions:
1. Backup current JATOS installation and data. 2. Download JATOS 3.9.5 or later from official website. 3. Stop JATOS service. 4. Replace installation with new version. 5. Restart JATOS service. 6. Verify functionality.
🔧 Temporary Workarounds
Implement IP-based rate limiting
allConfigure web server or firewall to limit login attempts per IP address
# Example nginx rate limiting: limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
# Then apply to login location: limit_req zone=login burst=5 nodelay;
Disable account lockout feature
allTemporarily disable account lockout mechanism if business impact is acceptable
# Modify JATOS configuration to set account lockout threshold to 0 or very high number
# Check JATOS documentation for specific configuration parameters
🧯 If You Can't Patch
- Implement network-level rate limiting using WAF or firewall rules to restrict login attempts per source IP
- Enable detailed authentication logging and implement alerting for suspicious login patterns
🔍 How to Verify
Check if Vulnerable:
Test by attempting 3 failed logins for any account within 1 minute, then verify legitimate login is blockedCheck Version:
Check JATOS version in web interface or run: java -jar jatos.jar --versionVerify Fix Applied:
After patching, repeat the test - account should not lock after 3 failed attempts within 1 minute📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts for same username within short timeframe
- Account lockout events in authentication logs
- Unusual pattern of 3 failed attempts exactly every minute
Network Indicators:
- Repeated POST requests to /jatos/login endpoint from same source
- HTTP 401 responses followed by account lockout messages
SIEM Query:
source="jatos.log" AND ("authentication failure" OR "failed login") | stats count by src_ip, username | where count >= 3