Exploiting the Gaps in Password Reset Verification
1 min read
Summary
Ehteshamul Haq has discovered a password reset flaw on Target’s website that could potentially allow an attacker to hijack an account.
The usual procedure after a user has clicked on a password reset link contained in an email, is for the system to check the authenticity of the token.
However, Haq found that the response from the server to the password reset request is verbose, and provides the first name of the user in the response headers.
This unintentional information leakage could provide an attacker with all the information they need to generate a valid password reset link, thereby enabling them to take control of an account.