Security vulnerabilities

  • Status Closed
  • Assigned To
    cbay
  • Private
Attached to Project: Security vulnerabilities
Opened by waloodi_109 - 01.11.2024
Last edited by cbay - 04.11.2024

FS#92 - A password reset page does not properly validate the authenticity token at the server side.

A password reset page does not properly validate the authenticity token at the server side.

1. Go to https://admin.alwaysdata.com/password/lost/ and request a new password.
2. Go to email, and click on the link.
3. Put the new password, submit and intercept the request; remove the authenticity token from the request and now forward it to the server.
you will see request still got completed, its shows token invalid in the browser but you can refresh the page and you see that user is logged in with new password.

Thanks,

Waleed Anwar

Closed by  cbay
04.11.2024 15:18
Reason for closing:  Duplicate
Additional comments about closing:  

https://security.alwaysda ta.com/task/82

04.11.2024: A request to reopen the task has been made. Reason for request: Its not a request expiration method, you can see clearly in video the browser shows the token is invalid but when you are refreshing the page it will redirecting you the login to the id, because token is not validated to the server side.
Admin
cbay commented on 04.11.2024 09:09

Hello,

I cannot reproduce. If I remove the 'token' parameter, I get:

The link used is invalid. Please make a new password reset request.

Even if I refresh multiple times.

Can you give me the link, without the 'token' parameter, that works?

Kind regards,
Cyril

oky i will see again

I am still reproducing this issue, i will make a video for easy understanding

Admin
cbay commented on 04.11.2024 12:52

I only need a link, not a video.

1. Go to https://admin.alwaysdata.com/password/lost/ and request a new password.
2. Go to email, and copy the link and paste it into Mozilla Firefox.
3. Put the new password, submit and intercept the request into Firefox; remove the authenticity token from the request and now forward it to the server.

Sir, you can try this one

Admin
cbay commented on 04.11.2024 15:08

What you do mean by "the authenticity token"? Use proper terms (e.g. I removed the the "foo" header from the request) or send a video.

Admin
cbay commented on 04.11.2024 15:18

The password forgotten link stops being valid once you've connected to the administration, which is automatically done (through a HTTP redirect) when you change the password.

But when i am removing the token, it showing token is invalid in the browser but after refreshing the browser it showing me to logged in the id with new password, there is a misconfiguration in the server side.

Loading...

Available keyboard shortcuts

Tasklist

Task Details

Task Editing