Description

Hello there! Hope you are having an amazing day! 🤗

Just found out, while testing one of diaspora* open servers, that the /user/edit endpoint has a limited case of "mass assignment", which enables an authenticated user to change their password and disable 2FA (or change its secret) without having to know their password, which is a requirement for doing these operations.

As it requires a user to be already authenticated, it is definitely not common to be explored/exploited, but it may be chained with other possible security issues and may also be used by any bad actors, after getting a victim session, as a way of inhibiting this victim future accesses.

Proof of Concept

First of all, have a way of intercepting and editing requests. I'll assume you are using a MiTM proxy tool such as Burp Suite/OWASP ZAP, but Firefox devtools may also do the trick :)

1 => Authenticate as any user and go to the account settings page (/user/edit);
2 => Click on the Change language button and intercept the POST request that goes to /user/edit;
3 => In the request body, change the user%5Blanguage%5D parameter to user%5Bpassword%5D and set as its value whatever new password you would like to have. Forward the request and boom! Password changed :)

The same could be applied to other user parameters, such as otp_required_for_login. You may define user%5Botp_required_for_login%5D as false and it will disable 2FA with no password confirmation being needed.

Impact

As it requires a user to be already authenticated, it is definitely not common to be explored/exploited, but it may be chained with other possible security issues and may also be used by any bad actors, after getting a victim session, as a way of inhibiting this victim future accesses.