OpenCart Predictable Password Reset Tokens
- Published: 28 Jul 2017
OpenCart Predictable Password Reset Tokens
Share
Type
- Weak Randomness
Severity
- High
Affected products
- OpenCart
CVE Reference
- TBD
Timeline
| 2017-01-24 | Issue discovered |
| 2017-01-30 | Multiple attempts to contact OpenCart |
| 2017-04-12 | OpenCart Support acknowledge the report, notify MWR that the email has been forwarded to the appropriate parties |
| 2017-05-04 | MWR inform OpenCart of intention to publish issue details within two weeks |
| 2017-05-09 | MWR suggest patches for the project |
| 2017-05-10 | MWR provide access to a demo installation of OpenCart, proof of concept exploit and email accounts |
| 2017-07-28 | No patch forthcoming - public release of advisory |
Description
OpenCart is an open source eCommerce platform that powers over 340,000 online stores.
Multiple vulnerabilities were discovered which when combined could provide an attacker with remote code execution against OpenCart installations.
Impact
An attacker that can register a user account or view basic CAPTCHAs generated by the application will be able to generate and predict the password reset tokens of any user account with a known email address, including those with administrator privileges.
A further issue within the administration panel could allow an attacker to gain remote code execution if the application utilises sendmail.
Cause
The application relies on PHP’s mt_rand() as a source of entropy when generating password reset links and basic captcha images. The abuse of this functionality allows an attacker to predict password reset tokens.
Further to this, the application allows unfiltered user input to be used as the 5th parameter of PHP’s mail() function which can lead to remote code execution when sendmail is being used as a mail transport agent.
Interim Workaround
Password reset functionality for the administrator’s account can be disabled within the administration panel. The setting can be found under Settings >Server > Allow Forgotten Password.
As a temporary measure, to disable password reset functionality for user accounts, the following modification can be made to OpenCart’s source code:
catalog/controller/account/reset.php:10
if (isset($this->request->get[‘code’])) { $code = $this->request->get[‘code’]; //Original Code $code = ”; //Modified Code } else { $code = ”; } }
MWR has not verified the temporary workaround in-depth and therefore cannot attest to the robustness of this interim workaround. As the vendor has not been forthcoming with a patch to remediate the issue within an appropriate timescale, best attempts have been made to both highlight the weakness and allow management of the risk to organisations that would not be aware.
Solution
MWR advise applying the interim workaround listed above as the vendor has not yet made a patch available and no plan for addressing the issue has been communicated.
Technical Details
Full technical details will be released at a later date.