Skip to main content

Insecure functionality

Description

A functionality that is part of the system can be leveraged by an attacker in order to negatively impact it.

Impact

Change the password after the security code has been compromised.

Recommendation

Validate on the server side that the answers to the questions are correct.

Threat

Any customer of the organization authorized from the Internet.

Expected Remediation Time

⌚ 60 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: L

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:X
  • Score:
    • Base: 4.2
    • Temporal: 4.2
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

Use some form of extra confirmation when changing passwords, for example, a hashed security code

<?php
if(isset($_POST['Submit'])){

$answer_1=trim($_POST["answer_1"]);

if (answer_verify($answer_1, $hash)) {
echo 'Password has been changed!';
} else {
echo 'Invalid answer';
}
}
?>

Non compliant code

The application allows to change a password only with the plain security code, which could be compromised or easily exploited

<?php
if(isset($_POST['Submit'])){

$answer_1=trim($_POST["CODE"]);

if (confirm_code($CODE)) {
echo 'Password has been changed!';
} else {
echo 'Invalid answer';
}
}
?>

Requirements