Recently, I have discovered a security flaw in a business website. This website has a password-protected "Partners Area", and like many websites it provides a form to reset the user's password.
When a user asks for a password reset for his nickname, a new password is sent to their email address and that password becomes immediately effective. The problem is (if this wasn't already a problem) that the new password is a fixed one, for all users. So an attacker can easily get access to any account.
Now, the only operations a user can do within their Partners Area are:
- View/change email address
- Change password
- Download some manuals and utilities (it's definitely not classified stuff)
- Fill out a repair form (then the process will continue by email)
- Download logos and images for marketing purposes
The only things I see for a malicious attacker to exploit are:
- Prevent future access to a legitimate user (which will probably be able to reobtain right after a phone call)
- Discover information about who the company customers are (guessing random nicknames and looking at their email address). Anyway, it's not something someone would keep as a secret.
Even if I am always very disturbed by things like this, in this case I must admit that it might not be a big deal. Are flaws like this acceptable compromises, in a context where not much harm can be caused?
Since I think someone misunderstood a detail: that website belongs to an external company. I have no role in the development of that website, and no control over any decision about it.