Junglewise Threat Intelligence

RedwoodJS account takeover in dbAuth forgot-password feature

Severity: low · CVSS 3.1 · Published 2022-11-10

Executive brief

RedwoodJS, a web development framework, contains a flaw in its built-in database authentication (dbAuth) system. An attacker can obtain a password reset token for any user simply by knowing their email address or username. This allows the attacker to reset the user's password and take full control of their account, potentially leading to data theft or unauthorized administrative actions.

Technical details

An information disclosure vulnerability exists in the RedwoodJS @redwoodjs/api package within the dbAuth 'forgot-password' implementation. The root cause is that the forgotPassword.handler() function returns the user object including sensitive fields like resetToken and resetTokenExpiresAt in the API response. A remote, unauthenticated attacker can exploit this by sending a request to the forgot-password API with a target's username or email, capturing the reset token from the response, and using it to set a new password. The vulnerability was introduced in version 0.38.0 and is fixed in versions 2.2.5 and 3.3.1.

Affected products

  • RedwoodJS @redwoodjs/api >= 0.38.0, < 2.2.5; >= 3.0.0, < 3.3.1

Timeline

  • 2022-11-03: patched: Fix merged into main branch
  • 2022-11-08: advisory: Release v3.3.1 published
  • 2022-11-09: advisory: Release v2.2.5 published
  • 2022-11-10: disclosed: GitHub Security Advisory published

References