Insecure functionality
Description
A functionality that is part of the system can be leveraged by an attacker in order to negatively impact it.
Impact
Change the password after the security code has been compromised.
Recommendation
Validate on the server side that the answers to the questions are correct.
Threat
Any customer of the organization authorized from the Internet.
Expected Remediation Time
⌚ 60 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: H
- Privileges required: L
- User interaction: N
- Scope: U
- Confidentiality: N
- Integrity: L
- Availability: L
Temporal
- Exploit code madurity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:X
- Score:
- Base: 4.2
- Temporal: 4.2
- Severity:
- Base: Medium
- Temporal: Medium
Code Examples
Compliant code
Use some form of extra confirmation when changing passwords, for example, a hashed security code
<?php
if(isset($_POST['Submit'])){
$answer_1=trim($_POST["answer_1"]);
if (answer_verify($answer_1, $hash)) {
echo 'Password has been changed!';
} else {
echo 'Invalid answer';
}
}
?>
Non compliant code
The application allows to change a password only with the plain security code, which could be compromised or easily exploited
<?php
if(isset($_POST['Submit'])){
$answer_1=trim($_POST["CODE"]);
if (confirm_code($CODE)) {
echo 'Password has been changed!';
} else {
echo 'Invalid answer';
}
}
?>