Skip to main content

Password reset poisoning

Need​

Secure password reset functionality

Context​

  • Usage of Go 1.16 for building high-performance and scalable applications
  • Usage of gin-gonic/gin for building web applications and APIs in Go
  • Usage of net/http for creating a web server in a Node.js application

Description​

Non compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
)

func main() {
	r := gin.Default()

	r.GET("/password-reset", func(c *gin.Context) {
		email := c.Query("email")
		domain := c.Query("domain")

		resetLink := "http://" + domain + "/reset?email=" + email
		// sending the password reset link to the user's email
		// ....

		c.JSON(http.StatusOK, gin.H{"resetLink": resetLink})
	})

	r.Run()
}

In the above code snippet, a password reset link is being created based on the user's email and domain provided in the query parameters. The reset link is then sent to the user's email for them to reset their password.

The vulnerability in this code is that the domain for the reset link is being taken from the query parameters without any validation. This means that an attacker can manipulate the request by changing the domain to one under his control. When the user clicks on the reset link, they will be directed to the attacker's site instead of the legitimate site. This can lead to phishing attacks where the attacker can steal the user's credentials.

Another issue is that the email is also taken from the query parameters without any validation. An attacker can use any email address to generate a password reset link. This can lead to unauthorized password resets.

Steps​

  • Sanitize and validate the 'email' and 'domain' inputs to prevent any malicious input.
  • Implement proper URL encoding to ensure that the generated reset link is valid and secure.
  • Use a secure connection (HTTPS) instead of HTTP for the password reset link to prevent interception and manipulation.
  • Implement a secure token-based authentication mechanism for the password reset process to prevent unauthorized access.
  • Implement rate limiting and account lockout mechanisms to prevent brute-force attacks on the password reset functionality.
  • Regularly update and patch the dependencies and libraries used in the application to address any known security vulnerabilities.
  • Perform security testing and code reviews to identify and fix any other potential vulnerabilities in the application.

Compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
	"net/url"
	"strings"
)

func main() {
	r := gin.Default()

	r.GET("/password-reset", func(c *gin.Context) {
		email := c.Query("email")
		domain := c.Query("domain")

		// Validate the email and domain
		if !strings.Contains(email, "@") || !strings.Contains(domain, ".") {
			c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid email or domain"})
			return
		}

		// Encode the email
		email = url.QueryEscape(email)

		resetLink := "https://" + domain + "/reset?email=" + email
		// sending the password reset link to the user's email
		// ....

		c.JSON(http.StatusOK, gin.H{"resetLink": resetLink})
	})

	r.Run()
}

The updated code includes several changes to address the password reset poisoning vulnerability:

  1. Input Validation: The code now checks if the 'email' and 'domain' inputs contain an "@" and "." respectively. This is a basic form of validation to ensure that the inputs are in the expected format. If the inputs are not valid, the function returns an HTTP 400 (Bad Request) response.

  2. URL Encoding: The 'email' input is now URL-encoded using the url.QueryEscape function. This ensures that the email is properly formatted for inclusion in a URL, preventing any potential manipulation of the reset link.

  3. Secure Connection: The reset link now uses HTTPS instead of HTTP. This ensures that the link is sent over a secure connection, preventing interception and manipulation by attackers.

Please note that this is a basic fix and additional security measures should be implemented as mentioned in the previous steps. These may include a secure token-based authentication mechanism for the password reset process, rate limiting and account lockout mechanisms to prevent brute-force attacks, regular updates and patches to dependencies and libraries, and regular security testing and code reviews.

References​

Last updated on