WS-2023-0332

Date: August 29, 2023

Account takeover is possible via password reset in alovoa. An attacker finds out the victim’s email address (or attacks admin@alovoa.com for more impact). The attacker obtains their password reset token from the application via email. The random seed can be cracked in about 2 hours and used to predict any amount of reset tokens (say, 10K or 10M). Then the attacker uses a password reset on their and the victim’s accounts, finds their token in the list, and uses the rest of the tokens one by one with the victim’s email at /password/change.

Language: Java