Abusing daemon logs for Privilege escalation under certain scenarios

Disclosed: 2014-06-18 13:44:53 By tunnelshade To phabricator
Unknown
Vulnerability Details
# Setup Needed + A normal user account + A momentary disruption of mail services # Replication steps + Login as **normal user** + Wait for **momentary disruption** of mail services + Use **Password Reset Link** for admin mail address + BOOM!!! + You can see the password reset link in the daemon logs because of interrupted mail service (check the screenshot) + Click on the link and upgrade to **Admin** # Attack Scenarios (Virtually unlimited) A moment misconfiguration of + Mail configuration + Firewall settings + Mail Service down etc.. etc.. (we just need a moment :P) I actually discovered this bug when gmail rejected my smtp credentials to prevent suspicious login :P.
Actions
View on HackerOne
Report Stats
  • Report ID: 16392
  • State: Closed
  • Substate: resolved
  • Upvotes: 2
Share this report