Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in OpenAEV allows an unauthenticated attacker to take over any user account. The issue stems from password reset tokens that do not expire and are only 8 digits long, enabling attackers to guess valid tokens and reset user passwords. This can lead to a complete compromise of the platform.
- Account takeover via password reset.
- Affects any registered user account.
- Attack is remote and unauthenticated.
Attack Path
How an attacker could exploit the issue
An attacker can achieve account takeover by exploiting OpenAEV's flawed password reset mechanism. They can repeatedly generate password reset tokens, which never expire, and then brute-force these tokens to gain access to any user account, including administrative ones. This attack requires no prior authentication and can be scaled to compromise multiple accounts by obtaining or guessing registered email addresses.
- Unauthenticated remote access is required.
- Vulnerable password reset functionality.
- Tokens do not expire.
- Predictable token format.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated attackers to take over any user account by resetting passwords, even administrator accounts. The flaws, specifically non-expiring and short password reset tokens, make exploitation reliably scalable. Attackers would favor this for its potential to gain full control of a sensitive security testing platform.
- Exploitable remotely without authentication.
- Reliable account takeover method.
- Public exploit code not yet observed.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize the immediate containment and remediation of OpenAEV instances due to a critical vulnerability allowing unauthenticated account takeover. Focus on identifying all deployed instances, assessing their exposure, and applying the patch to prevent further compromise.
- Patch OpenAEV to version 2.0.13 or later.
- Isolate affected OpenAEV services if patching is delayed.
- Monitor for signs of unauthorized password resets.
