MyBB Community Forums › Community Archive › Archived Forums › Archived Development and Support › MyBB 1.6 › 1.6 Security Management and Support v
Security Vulnerability?

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Threaded Mode
Security Vulnerability?
TheWiz Offline
Posts: 60
Threads: 8
Joined: Nov 2009
Reputation: 0
#1
Exclamation  2013-05-25, 01:14 AM (This post was last modified: 2013-05-26, 11:51 AM by Leefish.)
MyBB Community,

I received an email today confirming that I wanted to do a password reset on the administrators account. Obviously I did not initiate this activity and fortunately they didn't get the reset code. What is a common source of vulnerability where a remote user could initiate a reset code request?

Thank you,
TheWiz
Find
Nathan Malcolm Away

Former Staff
Posts: 13,646
Threads: 220
Joined: May 2010
Reputation: 550
#2
2013-05-25, 01:50 AM
This is not a vulnerability. Essentially, it's an email sent by the server saying "Hey, someone tried to reset the password for this account.". The only issue there would be is if someone gained access to your email account, in which case you're pretty much screwed anyway.

It's the same for most web applications. You enter the email address, the server sends an email, you as the owner of the account choose what to do. Didn't initiate the request? Ignore it. Perhaps change the email address of your forum account to something only you know (the person who made the request needs to know your email address in the first place) so it doesn't happen again.

Once again, there is no vulnerability. Smile
No longer involved in the MyBB project.
Find
SirGravzy Offline
Posts: 26
Threads: 16
Joined: Apr 2013
Reputation: 0
#3
2013-05-25, 03:18 AM
A good idea would also be make sure the front end doesn't tell the user which email address the recovery email was sent to.
Find
Nathan Malcolm Away

Former Staff
Posts: 13,646
Threads: 220
Joined: May 2010
Reputation: 550
#4
2013-05-25, 03:23 AM
(2013-05-25, 03:18 AM)SirGravzy Wrote: A good idea would also be make sure the front end doesn't tell the user which email address the recovery email was sent to.

You have to know the email address in the first place. You can't reset a password without knowing the email address of the account, and as I mentioned if they have access to your email account then you probably have other things to worry about.
No longer involved in the MyBB project.
Find
Wildcard Offline

Former Staff
Posts: 2,754
Threads: 63
Joined: Nov 2011
Reputation: 261
#5
2013-05-25, 03:31 AM
Yeah it would be a cool move to re-title the thread too Wink

That is expected behavior.
[retired]
Website Find
Stefan C. Offline
Posts: 84
Threads: 4
Joined: Apr 2013
#6
2013-05-25, 01:24 PM
(2013-05-25, 03:18 AM)SirGravzy Wrote: A good idea would also be make sure the front end doesn't tell the user which email address the recovery email was sent to.

That doesn't even make sense.. To request a password request YOU have to enter the email address of the account. I don't see what you are getting at here.
Find
ikhwanulfikri Offline
Posts: 607
Threads: 134
Joined: Feb 2013
Reputation: 6
#7
2013-05-26, 02:55 AM (This post was last modified: 2013-05-26, 02:58 AM by ikhwanulfikri.)
thread title is very interesting.

If you do not have to reset the password and suddenly there is a notice in the mail just ignore it.

because it will not reset your password as long as you do not do Klick on the email submission.

Big Grin
The only work of naughty children who had pulled his ears, until "they realize this is just ridiculous action"
Website Find


Forum Jump:


Users browsing this thread: 1 Guest(s)