CVE-2022-3945

Executive Summary

CVE-2022-3945 is an improper restriction of excessive authentication attempts vulnerability in the kareadita/kavita repository prior to version 0.6.0.3. It affects self-hosted Kavita instances exposed to the network, allowing unauthenticated attackers to perform unlimited login attempts. The impact is a critical (CVSS 9.4) risk of credential compromise, enabling account takeover on user and administrator accounts without rate limiting or account lockout mechanisms.

Technical Analysis

The vulnerability is classified as improper restriction of excessive authentication attempts. The NVD description and CNA title provide no function names, class names, URL endpoints, file paths, or parameter names. Therefore, analysis remains at the vulnerability-class level: the application fails to enforce any limit on repeated authentication requests to the login mechanism. This permits brute-force or password-spraying attacks against user credentials. No public PoC, exploit code, or nuclei template exists. Attack surface is limited to the authentication endpoint of internet-facing Kavita deployments.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.
Steps: 1) Reconnaissance/target identification via search for exposed Kavita instances. 2) The specific flaw class (lack of rate limiting) is triggered by sending repeated authentication requests to the login function without triggering any blocking or delay. 3) Payload/execution method at the vulnerability-class level consists of automated submission of credential pairs against the authentication mechanism. 4) Post-exploitation impact includes successful authentication bypass leading to account access and potential administrative control.

Impact Assessment

Business impact includes unauthorized access to private libraries, user data, and server configuration. Affected systems are all Kavita instances running versions prior to 0.6.0.3 that accept external authentication traffic. Blast radius can extend to full instance compromise if an administrator account is brute-forced. Reference CVSS subscores: the 9.4 score indicates network attack vector with no authentication or user interaction required and high impact on confidentiality and integrity.

Detection Guidance

Sigma Rule

title: Kavita Excessive Authentication Attempts
id: 8f3c2a1b-4e5d-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects multiple failed login attempts to Kavita
logsource:
  product: webserver
  service: access
detection:
  selection:
    c-uri-query|contains: "/api/account/login"
    sc-status: 401
  timeframe: 5m
  condition: selection | count() > 20
falsepositives:
  - Legitimate user password reset
level: high

YARA Rule

rule Kavita_BruteForce_Attempt {
    meta:
        description = "Detects patterns consistent with brute force against Kavita auth"
        author = "valtersit.com"
    strings:
        $auth = "/api/account/login" ascii wide
        $fail = "401" ascii
    condition:
        $auth and $fail
}

Suricata IDS Rule

alert http any any -> any any (msg:"Kavita Excessive Auth Attempts"; flow:established,to_server; http.uri; content:"/api/account/login"; http.method; content:"POST"; threshold:type both, track by_src, count 20, seconds 300; classtype:attempted-admin; sid:1002022; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where url.path == "/api/account/login" and http.response.status_code == 401] with runs=20

Splunk SPL Query

index=web sourcetype=access_combined uri="/api/account/login" status=401 
| stats count by src_ip 
| where count > 20 
| table src_ip count

Wazuh OSSEC Rule

<rule id="994101" level="10">
  <if_sid>31100</if_sid>
  <match>/api/account/login</match>
  <description>Kavita multiple failed logins detected</description>
  <group>authentication_failures,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: place Kavita behind a reverse proxy or WAF enforcing rate limiting on the authentication path; restrict access by IP allow-list. 2) Patch/upgrade steps: monitor the upstream repository for a future release addressing rate limiting; no vendor fix is currently available. 3) Long-term hardening: implement external authentication proxies, enable account lockout policies where possible, and deploy network-level brute-force protection.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-3945
https://github.com/kareadita/kavita
No CISA KEV entry. No known threat actor campaigns or exploit-in-the-wild evidence identified.