A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Uasoft Badaso versions up to 2.9.7 are vulnerable to a weak password recovery attack. This vulnerability, residing in the forgetPassword function, allows attackers to potentially compromise user accounts due to flawed token handling, despite the high complexity and difficult exploitability. The vendor has not responded to the disclosure, increasing the risk of exploitation.
Step 1: Target Identification: The attacker identifies a target user account within the Badaso application.
Step 2: Password Reset Request: The attacker initiates a password reset request, typically by providing the target user's email address.
Step 3: Token Interception/Prediction (Likely): The attacker attempts to intercept the password reset token sent to the target user's email or attempts to predict the token based on known information or vulnerabilities in the token generation algorithm.
Step 4: Token Manipulation/Brute-Force (If Prediction Fails): If the token cannot be intercepted, the attacker may attempt to brute-force the token, especially if the token generation algorithm is weak.
Step 5: Password Reset: The attacker uses the intercepted or predicted token to reset the target user's password.
Step 6: Account Compromise: The attacker logs in to the compromised account using the newly set password.
The vulnerability lies within the forgetPassword function of src/Controllers/BadasoAuthController.php. The root cause is likely a flaw in how the system generates, validates, or handles password reset tokens. Specifically, the system may be vulnerable to issues such as: