I'm confused about how to implement password reset functionality. I'm testing a Web application with two roles - administrator and normal user. Only administrators can use the password reset functionality (not has MFLAC).
This function find a user and load a view with basic data, for example "TEST_USER" with e-mail "firstname.lastname@example.org". The fields do not have the "readonly" attribute, so they can be modified by the administrator. When the user clicks the button "Reset" the application sends an email to "TEST_USER" with a URL (
The link loads a page with two fields, "new password" and "verify new password". Here I successfully changed the password and completed the process.
If an attacker changes the value in the field "e-mail" and enters "email@example.com" then the application will send the link to the attacker, thereby letting the attacker change the password. It is important to mention that this function is susceptible to CSRF because it does not have a token.
So I think that this is a vulnerability because an attacker or administrator can change the e-mail and reset the password for any user without them knowing about it. Using CSRF an attacker can send a malicious URL that resets the password to an administrator.
So I think that this is not a correct way to implement this functionality because I have heard that a good practice is sending only a token to the email address.
I think that the correct way to do this would be:
- Assure that the e-mail address belongs to the user whose password is being reset.
- You should send only one token instead of an URL.
- In the page
ResetPassword.aspxpaste the token.
- Verify the user with security questions.
- Let the user fill in "new password" and "verify new password"
Is this a vulnerability? Is this the correct way to implement this functionality?