Description

There is no rate limit on the password change feature on https://rdiffweb-demo.ikus-soft.com/prefs/general# which allows an attacker to bruteforce the old password and set a new password for the account

Proof of Concept

1. Go to https://rdiffweb-demo.ikus-soft.com/prefs/general#
2. Here you will see a password change feature
3. In the "old password" field enter any random string and in the "new password" and "confirm new password" field set the new password for the victim account
4. Capture the request using burpsuite and perform a bruteforce attack on the old password field
5. Due to the absence of rate limit on this endpoint an attacker can easily change the password of victim account

Attack Scenario: Let us consider a situation in which a victim is using a public device , in a library or cafe and forgets to log out of his account and an attacker gets access to this device .

Impact

Attacker can perform a bruteforce attack to change the password of the account hence resulting in a full account takeover issue