Amazon Cognito Rate Limit Bypass Vulnerability
Published Wed, Dec 27th, 2023
Platforms
Summary
A rate limit bypass vulnerability was discovered in Amazon Cognito, allowing attackers to potentially brute-force login credentials, password reset PINs, and MFA codes by sending requests in parallel. The vulnerability affected the main login flow, password reset function, and MFA process, potentially exposing user accounts to unauthorized access.
Affected Services
Amazon Cognito
Remediation
None required. Amazon has deployed a fix globally.
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/korniko98
Entry Status
Stub (AI-Generated)
Disclosure Date
Wed, Sep 20th, 2023
Exploitability Period
Until 2023/12/27
Known ITW Exploitation
-
Detection Methods
Monitor Cognito logs for unusual patterns of failed login attempts, password resets, or MFA verifications occurring in rapid succession from the same source.
Piercing Index Rating
-
Discovered by
Daniel Lümmel, LuemmelSec
