The captcha on the blog can be bypassed when posting comments | Community
Skip to main content
S
srinivasc110177
Level 4
October 30, 2015
Solved

The captcha on the blog can be bypassed when posting comments

  • October 30, 2015
  • 1 reply
  • 830 views

when adding captcha component  user could manipulate the captcha values as per the below .Could you please provide more inputs as how this could be avoid so that captcha value comes from server instead of UI value

< sling:include  path="<%= captchaPath %>" resourceType="foundation/components/form/captcha" replaceSelectors="captcha"/>


when user feeds data on captcha input then the below is called for validation
Then internally call /libs/foundation/components/form/captcha/captchavalidation.png.jsp

here we see that user can input is valid on the :cq:captchakey .Using browser technique we could edit the value of key and then it validate only against that.

So the cq:captchakey  can be manipulated as it does not come from server



String captchakey = slingRequest.getParameter("id"); -> This is the value coming from browser input if I am correct
String captchaUserValue=slingRequest.getParameter("captchaUserValue");

String captchacurrent = (Text.md5("" + (captchakey + mins))).substring(1, 6);
String captchaold = (Text.md5("" + (captchakey + minsold))).substring(1, 6);



 

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Aem-user1

The out of the box Captcha component seems to have limitations as you pointed out. If you want to run on on the server - i would recommend that you build a custom one using a 3rd party solution -- such as:

http://simplecaptcha.sourceforge.net/

Because this is a Java API for generating these values - you can build it as an OSGi. 

1 reply

A
Aem-user1Accepted solution
Level 2
October 30, 2015

The out of the box Captcha component seems to have limitations as you pointed out. If you want to run on on the server - i would recommend that you build a custom one using a 3rd party solution -- such as:

http://simplecaptcha.sourceforge.net/

Because this is a Java API for generating these values - you can build it as an OSGi. 

Terms & ConditionsAccessibility statement

Loading footer...