press
press copied to clipboard
Brute-force attack on monitor token
The monitoring.targets call needs a rate-limit or other security measures to protect the monitor token:
https://github.com/frappe/press/blob/768d55c05135e0e62d1af68d8f41ad298fb4b4a4/press/api/monitoring.py#L94-L100
Also vulnerable to the extremely theoretical timing attacks, given perfect network conditions, because of the string comparison 😄
To be fair, a long enough token should prevent brute-force attacks, probably.