Weak Password Recovery Mechanism for Forgotten Password in TeamPass - #VU140733

Vulnerability details

The vulnerability allows a remote attacker to reset a local user's password recovery state and bypass brute-force lockout protections.

The vulnerability exists due to a weak password recovery mechanism for forgotten password in app/sources/identify.php when handling the forgot local password flow after a failed login seeds session context. A remote attacker can send two specially crafted HTTP requests using the same unauthenticated session to reset a victim account's encryption keys, trigger delivery of a temporary password to the victim, and delete brute-force failure records to bypass brute-force lockout protections.

Exploitation requires the target account to use local authentication, have a registered email address, and not be disabled. Local password recovery must be enabled and SMTP must be configured.

Affected software

Remediation

External References

• https://github.com/nilsteampassnet/TeamPass/security/advisories/GHSA-cm5h-m2xm-5pxr