Mailing-List: contact notifications-help@ofbiz.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ofbiz.apache.org
Date: Thu, 22 Jun 2017 13:19:00 +0000 (UTC)
From: =?utf-8?Q?Tobias_Laufk=C3=B6tter_=28JIRA=29?= <jira@apache.org>
To: notifications@ofbiz.apache.org
Message-ID: <JIRA.12517989.1312511360000.80560.1498137540311@Atlassian.JIRA>
In-Reply-To: <JIRA.12517989.1312511360000@Atlassian.JIRA>
References: <JIRA.12517989.1312511360000@Atlassian.JIRA> <JIRA.12517989.1312511360150@jira-lw-us.apache.org>
Subject: [jira] [Commented] (OFBIZ-4361) Any ecommerce user has the ability
 to reset anothers password (including admin) via "Forget Your Password"
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Thu, 22 Jun 2017 13:19:08 -0000


    [ https://issues.apache.org/jira/browse/OFBIZ-4361?page=3Dcom.atlassian=
.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D1605=
9335#comment-16059335 ]=20

Tobias Laufk=C3=B6tter commented on OFBIZ-4361:
------------------------------------------

{quote}One remaining case is when the user forgets his username/login. He w=
ill (hopefully) always recall his email address so it would be cool if he c=
ould provide his email address. If there is exactly one valid login associa=
ted with this email address, the process can go on.

Else there should be some kind of message to call the administrator or some=
thing.{quote}
Instead of prompting the user to contact an administrator a solution that w=
ould not give away any information about the status of the given email addr=
ess in the system would be to send the request to contact an administrator =
per email. This way a potential hacker would have no way of getting any inf=
ormation about the data in the system.=20

Szenario 1:
The user has forgotten their password, but remembers the username.=20
# Klick "forgot password"=20
# provide username=20
# Message appears "An email with instructions to reclaim the account has be=
en send to the email adress provided by this account. If you didn't recieve=
 any email you may have used a different email address or mistyped your use=
rname"
#  If the username is valid and has an email address an email is sent with =
a link to choose a new password.

Szenario 2:
The user has forgotten their password and username but remembers the email =
address.
# Klick "forgot password"
# provide email address
# Message appears "An email with instructions to reclaim the account has be=
en send to this email adress. If you didn't recieve any email you may have =
used a different email address or mistyped it"
# If the email address is in the system and belongs
* to only one userlogin an email is sent with a link to choose a new passwo=
rd.
* to more than one userlogin an email is sent with instructions to contact =
an administrator/customer service

> Any ecommerce user has the ability to reset anothers password (including =
admin) via "Forget Your Password"
> -------------------------------------------------------------------------=
---------------------------------
>
>                 Key: OFBIZ-4361
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-4361
>             Project: OFBiz
>          Issue Type: Bug
>          Components: framework
>    Affects Versions: Release Branch 11.04, Trunk
>         Environment: Ubuntu and others
>            Reporter: mz4wheeler
>            Assignee: Michael Brohl
>              Labels: security
>
> Currently, any user (via ecommerce "Forget Your Password") has the abilit=
y to reset another users password, including "admin" without permission.  B=
y simply entering "admin" and clicking "Email Password", the following is d=
isplayed.
> The following occurred:
> A new password has been created and sent to you. Please check your Email.
> This now forces the user of the ERP to change their password.  It is also=
 possible to generate a dictionary attack against ofbiz because there is no=
 capta code required.  This is serious security risk.
> This feature could be reduced to a certain sub-set of users, whose login =
name is optionally in the format of an email address, and maybe require a c=
apta code to prevent dictionary attacks.
> For example, limit the feature to role "Customer" of type "Person" which =
was generated via an ecommerce transaction.


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)