New Zenner
- Join Date:
- Feb 2012
- Posts:
- 1
- Plugin Contributions:
- 0
[Fixed v1.5.1] Password reset vulnerability (entropy)
In order for a user to reset his password he needs to provide his email address. The same holds for administrator users through the admin interface. To generate a new password the application first seeds the mt_rand() function ,once per request, as follows
if (!isset($seeded)) {
mt_srand((double)microtime()*1000000);
$seeded = true;
}
and then uses mt_rand() to generate a random password. Because microtime values range from 0 to 1000000 there are only 1000000 possible passwords. By bruteforcing this would require about 6 hours under our testing configuration, which is already a major security problem. Furthermore, if an attacker submits two password reset requests one for his password and one for a target user's password in a very small time interval the two passwords generated will have initial seeds which are very close. By recovering the seed of his password the attacker can then bruteforce a reduced range of passwords. In our tests we were able to recover the target user's password with about 7000 requests which were made in less than 5 minutes over the internet. This issue affects all zen-cart versions that we checked ( 1.3.5 <= version <= 1.5.0), and both login interfaces (normal users and administrator).
Another, minor, issue with the password reset implementation is that the password is changed instantly when the password reset request is submitted. Although this is not a security issue by itself it can be quite annoying for users to have their password changed without their knowledge even if the new password is e-mailed back to them.
