CVE-2024-57610 PoC — Sylius 安全漏洞

Source

https://github.com/H3T76/CVE-2024-57610

Associated Vulnerability

Title:Sylius 安全漏洞 (CVE-2024-57610)
Description:A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that the Sylius core software is not intended to address brute-force attacks; instead, customers deploying a Sylius-based system are supposed to use "firewalls, rate-limiting middleware, or authentication providers" for that functionality.

Description

Lack of Rate Limiting in Sylius v2.0.2

Readme

# Lack of Rate Limiting in Sylius v2.0.2

Vendor Homepage: https://sylius.com/
### **Steps to Reproduce**
1.Navigate to https://store.sylius.com/login

2.Attempt multiple login requests using automated tools or scripts (e.g., Burp Suite, cURL).

3.Observe that no rate limiting is applied, and requests are processed without restriction.

## Poc video
https://drive.google.com/file/d/1o5nd8eStt0tgBpKJHUay02N_HVAUntPM/view
## Image
![alt text](https://imgur.com/9G9Skz7.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!