Loose loose Password Reset Vulnerability
As a financial website, hailun.com is China's largest loan search and service platform. The password reset vulnerability affects the security of funds in all user accounts of the entire system. Please pay attention to it!
1. This test finds that there is a design defect in the retrieval of the password using the mobile phone number. The text message code verification can be bypassed in step 2 (information confirmation) of password retrieval.
2. First, use a known mobile phone number for a normal password retrieval process. Record the response packet returned when step 2 (information confirmation) is as follows:
HTTP/1.1 200 OKServer: nginxDate: Tue, 10 Mar 2015 13:54:21 GMTContent-Type: text/html; charset = utf-8Connection: keep-aliveVary: Accept-EncodingExpires: Thu, 19 Nov 1981 08:52:00 GMTPragma: no-cacheCache-control: privateX-Powered-By: ThinkPHPContent-Length: 6613 <! DOCTYPE html PUBLIC "-// W3C // dtd xhtml 1.0 Transitional // EN "" http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd "> <Html xmlns =" http://www.w3.org/1999/xhtml "> <Head> <meta http-equiv =" Content-Type "content =" text/html; charset = UTF-8 "/> <title> good loan network-retrieve password </title> <link rel =" stylesheet "type =" text/css "href ="/src/c /password/base.css "/> <link rel =" stylesheet "type =" text/css "href ="/src/c/password/findpwd1.css "/> <script type =" text/javascript "src ="/src/j/jquery-1.8.0.min.js "> </script> <script type =" text/javascript "src ="/src/j/common. js "> </script> <script Src = "/src/j/home/login_findpwd.js? V = 1503102154 "type =" text/javascript "> </script>3. Perform the password retrieval operation again. For example, enter the mobile phone number and verify the image and then send the text message verification code.
4. Enter any text message code (123456 here) in step 2. You can see the returned response message indicating an incorrect text message code.
5. Replace the response package obtained from the first Password Reset operation as follows:
6. After the request is released, go to the Password Reset page and set the password to 333eee.
7. The password is successfully reset. You can use the password to successfully log on to the system.
Solution: Improve the authentication mechanism and verify both the front-end and server-end
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
