Authentication Bypass via Password Reset Flow Manipulation
قَالُوا سُبْحَانَكَ لَا عِلْمَ لَنَا إِلَّا مَا عَلَّمْتَنَا ۖ إِنَّكَ أَنتَ الْعَلِيمُ الْحَكِيمُ
Introduction
Authentication mechanisms are designed to ensure that only legitimate users can access their accounts. One of the most critical components of this process is the password reset functionality, which should strictly verify that a user has successfully completed the required verification steps before allowing a password change.
During security testing of Target account recovery functionality, an authentication bypass vulnerability was identified in the password reset flow.
The issue involved improper server-side validation of security-related parameters in the password reset confirmation request. By manipulating these parameters, it was possible to bypass the intended validation process and successfully change the account password without the expected security checks.
Vulnerability Details
The vulnerability was identified in the following endpoint:
- Host:
account.target.com - Endpoint:
POST /login/reset_confirmation - Vulnerability Type: Authentication Bypass
- CWE: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
During the password reset process, the application sends a POST request containing several parameters, including:
password: The new password.confirmPass: Password confirmation.requestDigest: A security-related request validation value.request_token: A request validation token.
The application appeared to accept the request even when both requestDigest and request_token were explicitly set to null.
Get A_box4’s stories in your inbox
Join Medium for free to get updates from this writer.
This indicated that the server was not properly enforcing the validation of these security-related parameters before processing the password reset operation.
Steps to Reproduce
- Navigate to the Target login page: `
https://account.Target.com/login` - Select the Reset Password option.
- Enter the email address associated with your authorized test account.
- Open the password reset link and navigate to the password creation page.
- Enter a new password and confirm it.
- Open Burp Suite and enable Intercept.
- Click the Reset Password button and intercept the following request: `
POST /login/reset_confirmation` - Locate the following parameters in the request body.
Original request:
password=NewPassword123%40&confirmPass=NewPassword123%40&requestDigest=[VALID_DIGEST]&request_token=[VALID_TOKEN]
9. Modify the security-related parameters by replacing their values with null.
password=NewPassword123%40&confirmPass=NewPassword123%40&requestDigest=null&request_token=null10. Forward the modified request to the server.
11. Observe that the password reset operation is successfully processed despite the modified parameters.
12. The test account’s password is changed, and the application authenticates the user and redirects them to the internal dashboard.
Impact
Improper validation of password reset security parameters can have severe security consequences.
An attacker who can exploit this behavior may be able to bypass the intended password reset verification mechanism and gain unauthorized access to a victim’s account.
