{"id":889,"date":"2020-05-09T04:15:56","date_gmt":"2020-05-09T03:15:56","guid":{"rendered":"http:\/\/zerothcode.com\/blog\/?p=889"},"modified":"2020-10-08T05:40:50","modified_gmt":"2020-10-08T04:40:50","slug":"password-reset-link-doesnt-expires","status":"publish","type":"post","link":"https:\/\/zerothcode.com\/blog\/password-reset-link-doesnt-expires\/","title":{"rendered":"Password Reset Link Doesn\u2019t Expires On Email Change"},"content":{"rendered":"

Summary : Password<\/strong><\/p>\n

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. This can be listed under improper authentication.\u00a0 Password<\/strong><\/h3>\n

When any user sends the password reset link but does not use it and it remains unused in the user\u2019s inbox,<\/p>\n

here if in any case, the attacker gets access to the victim\u2019s main inbox (gmail or yahoo) he\/she can takeover the account on the other websites which is being used by the user with the same email.<\/p>\n

Why does this happen?\u00a0\u00a0<\/strong><\/p>\n

    \n
  1. Websites forget to set the email expiration time.<\/li>\n
  2. Websites don\u2019t expire the old password reset link on email change<\/li>\n
  3. Websites don\u2019t expire the password reset token after being used once<\/li>\n<\/ol>\n

    How to find this vulnerability ?\u00a0\u00a0<\/strong><\/p>\n

      \n
    1. Go to your target website and send a reset link to your account<\/li>\n<\/ol>\n
      \n
      \n
      \n
      \n
      \n
      \n

       <\/p>\n<\/div>\n

      \"Password\"
      Password<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>
      Password Reset Page\u00a0\u00a0<\/figcaption><\/figure>\n

      2. Now don\u2019t use it, just login to your account and change the email Password<\/p>\n

      \n
      \n
      \n
      \n
      \n
      \n

       <\/p>\n<\/div>\n

      \"Password\"
      Password<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>
      Email Changed<\/figcaption><\/figure>\n

      3. Now after changing the email and confirming it logout of the account and use that old password reset link to reset the password which was sent to your old email address.<\/p>\n

      \n
      \n
      \n
      \n
      \n
      \n

       <\/p>\n<\/div>\n

      \"Password\"
      Password<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>
      Password Reset Link to Old Email<\/figcaption><\/figure>\n

      4. Now Reset the password<\/p>\n

      \n
      \n
      \n
      \n
      \n
      <\/div>\n
      \"Password\"
      Password<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>
      Resetting the password<\/figcaption><\/figure>\n

      5. Log in with the changed password<\/p>\n

      \n
      \n
      \n
      \n
      \n
      <\/div>\n
      \"Password\"
      Password<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>
      Logging in with the changed password<\/figcaption><\/figure>\n

      NOTE : In real case scenario it is only possible if your main account (gmail\/yahoo) gets compromised. But 70 out of 100 websites accepts this risk so you can report it.<\/p>\n

      Thank You \ud83d\ude42<\/p>\n

      You May also Read : http:\/\/zerothcode.com\/blog\/otp-bypass-developers-check\/<\/a><\/p>\n

      You May also Read : http:\/\/zerothcode.com\/blog\/privilege-escalation-hello-admin\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

      Summary : Password When an actor claims to have a given identity, the software does not prove or insufficiently proves<\/p>\n","protected":false},"author":1,"featured_media":890,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[51],"tags":[],"yst_prominent_words":[1188,1157,1319,1316,1320,501,1318,1317,1314,1312,1311,1310,937,1313,1315,496,464],"class_list":["post-889","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials"],"_links":{"self":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/comments?post=889"}],"version-history":[{"count":0,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/889\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media\/890"}],"wp:attachment":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media?parent=889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/categories?post=889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/tags?post=889"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/yst_prominent_words?post=889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}