Password reset broken logic | Dec 21, 2022

Introduction

Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: Password reset broken logic! Without further ado, let’s dive in.

Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆

Background

This lab’s password reset functionality is vulnerable. To solve the lab, reset Carlos’s password then log in and access his “My account” page.

Your credentials: wiener:peter
Victim’s username: carlos

Exploitation

Home page:

Login page:

In here, we can see that there is a forgot password link:

Let’s try to reset user wiener password:

Email client:

Let’s click that link to reset password:

Hmm… Let’s submit a password and intercept the request via Burp Suite:

When we clicked the submit button, it’ll send a POST request to /forgot-password, with parameter temp-forgot-password-token, username, new-password-1, and new-password-2.

Hmm… What if I change the username value to carlos?

We’re user carlos! The application doesn’t check temp-forgot-password-token is used or not, and the username value is correct or not.

What we’ve learned:

Password reset broken logic