Reminds me of a bug where you could brute force an account by putting an array o... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

bluedino on Jan 27, 2024 | parent | context | favorite | on: Gitlab password reset bug leaves more than 5.3K se...

Reminds me of a bug where you could brute force an account by putting an array of passwords in the login form.

It was some junky web interface to a spam appliance of all things, I'm not sure if it was intentional, or just some php rookie wrote the code.

One of our users discovered it when they had a (rare at the time) special character in their password.

PufPufPuf on Jan 27, 2024 [–]

Ruby on Rails accepts arrays as parameters to the ORM's ".where(...)", which means "OR" between the array values. So if the code does something like "User.where(name: name, password: password)", I could totally see this happening.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact