Skip to main content

Password change without identity check

Need​

Enforce strong identity verification for password changes

Context​

  • Usage of C# 7.1 for developing applications with advanced language features and improvements
  • Usage of _userManager for user management and authentication
  • Usage of ChangePasswordViewModel for managing password change functionality
  • Usage of IActionResult for handling and returning HTTP responses in a structured manner
  • Usage of ModelState for managing and validating the state of data models
  • Usage of NotFound for handling 404 errors in a web application
  • Usage of BadRequest for handling and returning HTTP 400 Bad Request responses
  • Usage of the Ok library for handling HTTP responses
  • Usage of User.Identity.Name for accessing the authenticated user's name
  • Usage of _userManager.GetUserId(User) to retrieve the user ID from the user manager

Description​

Non compliant code​

[HttpPost]
public async Task<IActionResult> ChangePassword(ChangePasswordViewModel model)
{
    if (ModelState.IsValid)
    {
        var user = await _userManager.FindByNameAsync(User.Identity.Name);

        if (user == null)
        {
            return NotFound($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
        }

        var changePasswordResult = await _userManager.ChangePasswordAsync(user, model.OldPassword, model.NewPassword);

        if (!changePasswordResult.Succeeded)
        {
            return BadRequest("Failed to change password");
        }

        return Ok("Your password has been changed.");
    }

    return BadRequest(ModelState);
}

The above code is a typical example of a password change function in an ASP.NET Core application. It is using the built-in UserManager service to handle the password change.

The function starts by checking if the model state is valid. If it is, it then tries to find the user by the username stored in the user's identity.

If the user is found, it proceeds to change the password. Here lies the vulnerability: the system changes the password without verifying the identity of the user making the request. This means that if an attacker can somehow get a user's session (for example, by stealing their cookies), they can change the user's password without needing to know the old one.

This is a major security flaw, as it can lead to unauthorized access to user accounts. The system should always request the old password before allowing the user to set a new one. This ensures that only the person who knows the current password can change it.

Steps​

  • Implement an additional identity verification mechanism before allowing the password change.
  • This can include requesting the user's current password as an additional input.
  • Alternatively, you can implement a two-factor authentication (2FA) mechanism.
  • Ensure that the additional identity verification mechanism is properly implemented and secure.
  • Validate the user's current password or the 2FA code before proceeding with the password change.
  • Only allow the password change if the additional identity verification is successful.
  • Update the code to enforce the use of the additional identity verification mechanism.
  • Test the updated code thoroughly to ensure it functions as intended and does not introduce any new vulnerabilities.

Compliant code​

[HttpPost]
public async Task<IActionResult> ChangePassword(ChangePasswordViewModel model)
{
    if (ModelState.IsValid)
    {
        var user = await _userManager.FindByNameAsync(User.Identity.Name);

        if (user == null)
        {
            return NotFound($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
        }

        // Check if the old password is correct
        var passwordCheck = await _userManager.CheckPasswordAsync(user, model.OldPassword);
        if (!passwordCheck)
        {
            return BadRequest("Invalid current password");
        }

        var changePasswordResult = await _userManager.ChangePasswordAsync(user, model.OldPassword, model.NewPassword);

        if (!changePasswordResult.Succeeded)
        {
            return BadRequest("Failed to change password");
        }

        return Ok("Your password has been changed.");
    }

    return BadRequest(ModelState);
}

The updated code now includes an additional identity verification mechanism before allowing the password change. This is done by checking if the old password provided by the user matches the current password in the system.

The CheckPasswordAsync method is used to verify the old password. This method takes in two parameters: the user object and the password to check. It returns a boolean value indicating whether the password is correct or not.

If the old password is incorrect, the method returns a BadRequest response with a message indicating that the current password is invalid. This prevents the password change from proceeding.

If the old password is correct, the method proceeds to change the password as before.

This additional identity verification mechanism enhances the security of the password change process by ensuring that only the legitimate user can change their password. It also helps to prevent unauthorized password changes.

Remember to test the updated code thoroughly to ensure it functions as intended and does not introduce any new vulnerabilities.

References​

Last updated on