Email Verification Bypass Leads To Account Takeover in bookwyrm-social/bookwyrm

Valid

Reported on

Jul 12th 2022

  1. Hello maintainer, i noticed that there is no ratelimit protetcion on https://book.dansmonorage.blue/confirm-email endpoint, so we can perform bruteforce attack

Steps to reproduce:

  1. Create a acount with victims email id
  2. When the account is created, its ask for email confirmation via validating OTP on https://book.dansmonorage.blue/confirm-email
  3. Enter any random OTP and try to perfrom bruteforce attack

Patch recommendation:

  1. Add ratelimit protecion on POST confirmation email endpoints/parameters

Impact

  1. Pre-Account Takeover
We are processing your report and will contact the bookwyrm-social/bookwyrm team within 24 hours. a year ago
A GitHub Issue asking the maintainers to create a SECURITY.md exists a year ago
We have contacted a member of the bookwyrm-social/bookwyrm team and are waiting to hear back a year ago
We have sent a follow up to the bookwyrm-social/bookwyrm team. We will try again in 7 days. a year ago
Akshay Ravi
a year ago

Researcher

Hello @maintainer any update on this?

We have sent a second follow up to the bookwyrm-social/bookwyrm team. We will try again in 10 days. a year ago
Mouse Reeve validated this vulnerability a year ago
Akshay Ravi has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Mouse Reeve marked this as fixed in 0.4.5 with commit 7bbe42 a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
Akshay Ravi
a year ago

Researcher

@maintainer are you happy to assign a CVE? please confirm, then only admin can move further

Akshay Ravi
a year ago

Researcher

@Mouse Revee @maintainer please confirm are you happy to assign a CVE?😇

Akshay Ravi
a year ago

Researcher

@admin can you pls assign a CVE for this?

Jamie Slome
a year ago

Admin

Same as the other report, we will wait for the maintainer to give approval for a CVE before proceeding. I would recommend leaving a comment on the commit asking if the maintainer is happy for huntr.dev to publish one.

Akshay Ravi
a year ago

Researcher

@admin maintainer has requested a CVE via github here is the link, check that: https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-jvp3-mqv8-5rjw

So can we assign a CVE here?

Jamie Slome
a year ago

Admin

I've dropped a message on the other report asking the maintainer :)

Jamie Slome
a year ago

Admin

CVE-2022-2651 has been assigned and is all sorted!

to join this conversation