CVE-2020-11052: 
Ruby vulnerability analysis and mitigation

CVE-2020-11052 is a brute force vulnerability discovered in Sorcery versions before 0.15.0, affecting the password authentication mechanism. The vulnerability was identified on April 30, 2020, and patched in version 0.15.0 released on May 2, 2020. The issue specifically impacts the brute force protection submodule, where protection fails to re-enable after the initial lockout period expires until a successful login occurs (GitHub Advisory).

The vulnerability stems from a flaw in the authenticate method where callbacks would return before execution if an invalid password was provided. This caused the brute force protection to only work for the first lockout period and would only reset after a successful login attempt. The issue received a CVSS v3.1 base score of 9.8 (CRITICAL) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while GitHub assessed it with a score of 8.3 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts) (NVD).

The vulnerability allows attackers to continue login attempts after the initial login lock time period has expired. The brute force protection becomes ineffective as it fails to reject subsequent login attempts, potentially allowing attackers to eventually guess the correct password through sustained brute force attacks (GitHub Issue).

The vulnerability is exploitable remotely without requiring any privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit. The issue specifically affects systems using the built-in brute force protection submodule, while systems using permanent account lockout are not affected (GitHub Advisory).

The vulnerability was patched in Sorcery version 0.15.0. Users are strongly recommended to upgrade to this version or later. For those unable to upgrade immediately, no direct workarounds are available except for monkey patching the authenticate method provided by Sorcery (GitHub Advisory, GitHub PR).