- Status Closed
-
Assigned To
cbay - Private
Opened by waloodi_109 - 04.04.2025
Last edited by cbay - 04.04.2025
FS#149 - Failure to invalidate sever after password change in Webdav
Failure to invalidate sever after password change in Webdav
Hello Team,
I hope you are doing well. While Researching in your domain I found Failure to invalidate server after password change vulnerability in your domain.
Steps to Reproduce:
1.Go to https://admin.alwaysdata.com/webdav/ and set a password for user and then submit.
2.Then, go to your PC to Connect Webdav Server with your Windows/Linux.
3.Again go tohttps://admin.alwaysdata.com/webdav/ and then change the password and submit it.
4.You can see that server is still validated and files are accessible in your webdav server which is connected with your PC.
Impact
If attacker have gain access in someone Pc, he/she access these files without any error. As server is not destroyed, attacker will be still access these files, cause his server is still active.. Server should be destroyed can take effect immediately when password is changed.
Thank You,
Waleed Anwar
Loading...
Available keyboard shortcuts
- Alt + ⇧ Shift + l Login Dialog / Logout
- Alt + ⇧ Shift + a Add new task
- Alt + ⇧ Shift + m My searches
- Alt + ⇧ Shift + t focus taskid search
Tasklist
- o open selected task
- j move cursor down
- k move cursor up
Task Details
- n Next task
- p Previous task
- Alt + ⇧ Shift + e ↵ Enter Edit this task
- Alt + ⇧ Shift + w watch task
- Alt + ⇧ Shift + y Close Task
Task Editing
- Alt + ⇧ Shift + s save task
Hello,
The old password is automatically invalid 5 minutes after the password change. We do not believe that's a vulnerability.
Kind regards,
Cyril
Server should be directly destroyed, if the password is Changed. Attacker Can Create or Delete Files in that 5 minutes which you're Saying
I Strongly recommend you to open that ticket and you should fix it, In 5 minutes Attacker can retrieve files to Change or Delete it.
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<a href="javascript:alert('XSS')">Click me</a>
<svg/onload=alert('XSS')>
Any Update??