Account Takeover Using Password Reset Token
I was testing an application and noticed that the forgot password functionality is vulnerable. It allows an attacker to manually craft a password reset token, and use it to reset a victim’s account password, and take full control of the account.
Attack Scenario
How I reset the victim's account password and take full control of his account.
I sent a password reset token to my email id - singh.jayvardhan02@gmail.com.
Below is the password reset toekn which I received.
https://******.com/api/v1/reset-password/9ISGvv8gqa7z5eccc04942b9c440257a36fe28381632b70d973b4ac9
After some time, I sent another password reset token to same email ID,
https://******.com/api/v1/reset-password/9ISGvv8gqa7z5eccc04942b9c440257a36fe28381632b70d973b4ac9
Noticed that both the password reset token are same.
Analyzing this, I sent password reset token to my another account..
Password reset token for email id - jayvardhansingh02@gmail.com
https://***.com/api/v1/reset-password/9ISGvv8gqa7z5ecc2cc927bf84a80e646d5e782eeeea853ff61d7cf9f1e
After analyzing the password reset token, I observed that first 16 characters are identical in all the tokens, and rest is SHA1 hash value of the email ID.
If I break the tokens first 16 character are same for both email id - 9ISGvv8gqa7z5ecc
SHA1 hash for singh.jayvardhan02@gmail.com - c04942b9c440257a36fe28381632b70d973b4ac9
SHA1 hash for jayvardhansingh02@gmail.com - 927bf84a80e646d5e782eeeea853ff61d7cf9f1e
After that, I created another account (victim's account) using email id sectest24@gmail.com
Based on above observation, I created a password reset token manually for the victim’s account.
Password reset token for victim’s email id - sectest24@gmail.com
https://*****.com/api/v1/reset-password/9ISGvv8gqa7z5ecc2cc046541723cb440b5de0bfb9afa9649c56bcef
Using above crafted password reset link, I successfully able to change the victim's account password.
Recommendation
Generate a one-time token linked to the user account. Create random token instead of the email-ID hash, and expire it immediately after the password is reset.
No comments:
Post a Comment