Account Takeover Series 3: Account Takeover through Insecure Direct Object Reference

Working of Password Reset Functionality

1. A legitimate user who has forgotten his password goes to the password reset page and enters his email id or username.
2. Then, the application checks whether the user is present in its database and creates a unique temporary token that is associated with the user’s account.
3. An email is sent to the user containing a link with the token attached as a parameter. This link can be used to reset the account’s password.

Steps to Reproduce:

1. The application provides a login panel in which password reset functionality is present. We can abuse this functionality.
2. We also have our own exploit server, which can be used to get the victim’s token from the password reset functionality.
3. Enter the victim’s name in the password reset input field and click on submit.
4. Intercept this request in a proxy server like Burp.
5. Change the host header to the exploit server’s domain.
6. Now let the request pass by turning the intercept off. On the browser, it shows that the password reset link is sent in the mail.
7. As soon as the victim clicks on the link in his mail, our exploit server gets a request, and the reset token gets logged.
8. This token can now be used to reset the password of our victim Carlos and take over his account.
9. We have successfully taken over Carlos’s account.

Mitigation

1. Try to avoid the usage of the host header in the server-side code.
2. If the inclusion of the current domain is necessary, then it should be specified in a custom configuration file in the server-side code, and should not depend upon the host header.
3. If the host header specifically is required to be included in the server-side code then it must be validated from a list of whitelisted domains.
4. Disable the support of Host override headers like X-Forwarded-Host, X-Forwarded-For, etc.

Related Blogs