MyBB Community,
I received an email today confirming that I wanted to do a password reset on the administrators account. Obviously I did not initiate this activity and fortunately they didn't get the reset code. What is a common source of vulnerability where a remote user could initiate a reset code request?
Thank you,
TheWiz
This is not a vulnerability. Essentially, it's an email sent by the server saying "Hey, someone tried to reset the password for this account.". The only issue there would be is if someone gained access to your email account, in which case you're pretty much screwed anyway.
It's the same for most web applications. You enter the email address, the server sends an email, you as the owner of the account choose what to do. Didn't initiate the request? Ignore it. Perhaps change the email address of your forum account to something only you know (the person who made the request needs to know your email address in the first place) so it doesn't happen again.
Once again, there is no vulnerability.
A good idea would also be make sure the front end doesn't tell the user which email address the recovery email was sent to.
(2013-05-25, 03:18 AM)SirGravzy Wrote: [ -> ]A good idea would also be make sure the front end doesn't tell the user which email address the recovery email was sent to.
You have to know the email address in the first place. You can't reset a password without knowing the email address of the account, and as I mentioned if they have access to your email account then you probably have other things to worry about.
Yeah it would be a cool move to re-title the thread too
That is expected behavior.
(2013-05-25, 03:18 AM)SirGravzy Wrote: [ -> ]A good idea would also be make sure the front end doesn't tell the user which email address the recovery email was sent to.
That doesn't even make sense.. To request a password request YOU have to enter the email address of the account. I don't see what you are getting at here.
thread title is very interesting.
If you do not have to reset the password and suddenly there is a notice in the mail just ignore it.
because it will not reset your password as long as you do not do Klick on the email submission.
The only work of naughty children who had pulled his ears, until "they realize this is just ridiculous action"