Skip to main content

Insecure functionality

Description​

A functionality that is part of the system can be leveraged by an attacker in order to negatively impact it.

Impact​

Change the password after the security code has been compromised.

Recommendation​

Validate on the server side that the answers to the questions are correct.

Threat​

Any customer of the organization authorized from the Internet.

Expected Remediation Time​

⌚ 60 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: L

Temporal​

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result​

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:X
  • Score:
    • Base: 4.2
    • Temporal: 4.2
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples​

Compliant code​

Use some form of extra confirmation when changing passwords, for example, a hashed security code

<?php
if(isset($_POST['Submit'])){

  $answer_1=trim($_POST["answer_1"]);

  if (answer_verify($answer_1, $hash)) {
    echo 'Password has been changed!';
  } else {
    echo 'Invalid answer';
  }
}
?>

Non compliant code​

The application allows to change a password only with the plain security code, which could be compromised or easily exploited

<?php
if(isset($_POST['Submit'])){

  $answer_1=trim($_POST["CODE"]);

  if (confirm_code($CODE)) {
    echo 'Password has been changed!';
  } else {
    echo 'Invalid answer';
  }
}
?>

Requirements​