CVE-2022-40084 OpenCRX v5.2.2 was vulnerable to password enumeration due to difference in messages received during a password reset. This could enable an attacker to determine if a username, email or ID is valid.
The vulnerability here is that the transition of a new password would result in a different error code being stored in the database. Due to the nature of the software where one error code could represent a variety of things, it was difficult to determine what this error code actually meant. Now, thanks to the work of Derek Collard, we can now confirm that this error code could be used to determine an email address. As a result, an attacker could now use this information to correlate an email address with the user’s password reset credentials and potentially gain access to their account. As this vulnerability was only discovered by Collard, we are not sure if this was a targeted attack or if he discovered it by accident.
Discovered By: Derek Collard
Derek Collard discovered a flaw in the software that allowed an attacker to gain access to an email address through the password reset process. The vulnerability occurred when the system would return a different error code for each user that would change. As a result, it was difficult to detect if someone has been logging into a user’s account. This could have led to unauthorized access to their account.
The impact of this vulnerability is that the attacker could potentially use this information to correlate an email address with the user's password reset credentials and gain access to their account. As this vulnerability was only discovered by Collard, we are not sure if this was targeted or accidental.
Password Reset By Email Vulnerability
Derek Collard discovered a vulnerability in the password reset process for email accounts that would allow an attacker to correlate an email address with the user’s password reset credentials and potentially gain access to their account. As this vulnerability was only discovered by Collard, we are not sure if this was a targeted attack or if he discovered it by accident.
Why Should I Care?
This vulnerability could have been exploited in a variety of ways and the repercussions could have been beyond what we can imagine. Here are some of the scenarios that you should be aware of:
1) If a malicious user had gained access to this database, they could reset an account’s password and gain access to the account without any other form of authentication.
2) If this vulnerability was exploited by an automated process, such as a script, or by someone using automated tools, such as via SQL injection, then those accounts would be compromised without any further intervention.
3) If this vulnerability was exploited on a vulnerable website where no other controls were in place to keep out unwanted users, then hackers could also use this vulnerability to gain access to the site or database.
4) This vulnerability has also been present since 2013 when Collard discovered it. As there is no way for website owners or administrators to know about this potential problem unless they found out about it themselves (like Collard did), there is nothing preventing them from not fixing it until something bad happens.
Timeline
Published on: 10/20/2022 14:15:00 UTC
Last modified on: 10/21/2022 18:16:00 UTC
References
- https://github.com/ciph0x01/OpenCRX-CVE/blob/main/CVE-2022-40084.md
- https://cwe.mitre.org/data/definitions/204.html#:~:text=User%20enumeration%20via%20discrepancies%20in%20error%20messages.,-CVE%2D2004%2D0294&text=Bulletin%20Board%20displays%20different%20error,brute%20force%20password%20guessing%20attack.
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40084