Horizon Alert
Summary of the vulnerability and why it matters
The EIP Plus product, developed by Hundred Plus, has a critical security flaw in its password recovery feature that could allow unauthorized individuals to reset any user's password. This vulnerability stems from a weak password recovery mechanism, enabling remote attackers to potentially guess or brute-force the password reset link. This could lead to unauthorized account takeovers within affected systems.
- Password reset links can be guessed or brute-forced.
- This allows unauthorized access to any user account.
- Confirm relevance and exposure of EIP Plus systems.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by targeting the password reset function. By predicting or brute-forcing the "forgot password" link, an attacker can gain unauthorized control over any user's account.
- No authentication required.
- Predict or brute-force password reset link.
- Reset any user's password.
Live Threat
Current exploitation, exposure, and threat context
An unauthenticated remote attacker could reset any user's password by predicting or brute-forcing the 'forgot password' link, potentially leading to unauthorized account access. This could affect user accounts and any data or services associated with them, when supported by the advisory.
- User accounts and associated data.
- Predict or brute-force the password reset link.
- Unauthorized account access and control.
Operational Fix
Recommended remediation, mitigation, and detection steps
To address this critical vulnerability, the application owners and the platform or infrastructure teams are likely responsible for managing EIP Plus. The first actionable step is to identify all instances of the affected software, confirm their exposure and business criticality, and then assign ownership for remediation planning.
- Own by application and platform teams.
- Verify affected systems and exposure.
- Plan remediation based on risk.
