Weak Password Change Mechanism in athou/commafeed

Valid

Reported on

Jul 5th 2022


Description

When setting a new user password, commafeeddoes not require knowledge of the original password or using another form of authentication.

Proof of Concept

1. Log in as a regular user 
2. Go to the profile settings link
3. Select Set Password
4. Enter any 6-character password string (this form is not constrained by the common passwords blocked in initial user creation).

Impact

If an attacker can gain access to an active user session (i.e. accessing terminal when user stands up), it would not be necessary to know the victim's current password in order to fully compromise the account.

We are processing your report and will contact the athou/commafeed team within 24 hours. a month ago
Jérémie Panzer modified the Severity from Critical to Low 21 days ago
The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
Jérémie Panzer validated this vulnerability 21 days ago
saharshtapi has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Jérémie Panzer confirmed that a fix has been merged on 899a8d 21 days ago
The fix bounty has been dropped
to join this conversation