Account takeover through password reset functionality

This post is going to show how I was able to achieve an account takeover on a bug bounty program. Details on the target site are going to be heavily redacted due to the policy of public disclosure. That and the remediation is still ongoing.

Typically when approaching targets I will always navigate the site as if I were a “normal user”, doing this allowed me to find an interesting endpoint that allowed a user to reset a password by providing the email.

This caught my eye right away so what I did was input one of my registered emails into this field with the Burp intercept on. The POST response to this looked like:

Notice the parameters Email and Username. The application actually uses the email as the username after you’ve made an account. This means we can change the email parameter to an email that is not attached to the username. I modified the request to look like this:

The email parameter is now an attacker controlled email.

The response to this request looks like the following:

We can see we are getting an “OK;LinkSent” response, this means we should receive an email with a password reset link to the email we are under control over. In this case that email is “rewscel-attacker@notreal.email” and the username we are taking over is “rewscel-account@notreal.email” (victim).

After checking my email (rewscel-attacker@notreal.emai) I saw there was a password reset link sitting there waiting for me. The link looked like:

All that has to be done now is for the attacker to click the link and change the password. This bug allows the attacker to takeover any account as long as they know the email.

More information on this type of bug: https://cwe.mitre.org/data/definitions/620.html