Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in the wger workout and fitness manager could allow an attacker to take over any user's account. The issue lies in how the system checks user permissions before resetting passwords, creating a loophole when both the attacker and victim are not assigned to a specific gym. This allows an unauthorized user to reset another user's password and gain full access.
- Full account takeover is possible.
- Affects users without gym assignments.
- Plaintext password exposed in response.
Attack Path
How an attacker could exploit the issue
An attacker with basic user privileges and no gym assignment can exploit this flaw to reset the password of any other user who also has no gym assignment. This is achieved by abusing the faulty authorization check in password reset and user edit functions, which incorrectly allows the bypass when both users lack a gym. The new password is then displayed directly in the HTML response, enabling an immediate account takeover.
- Requires authenticated access.
- Targets password reset functionality.
- Exploits `None != None` logic flaw.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows for account takeover by exploiting a flawed authorization check in password reset functionality. While the vulnerability is rated critical and offers direct account access, its exploitation is likely limited to authenticated users with specific permissions within a gym-scopable environment. Attackers might favor this if they can gain initial low-privilege access.
- Exploitation requires authentication.
- No public exploit code observed.
- Fix available in version 2.6.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Focus on containing and monitoring services using wger versions prior to 2.6, as a critical vulnerability allows for account takeover by bypassing authorization checks. Given the advisory is marked as "Deferred," a patch is available but may not have been universally applied.
- Upgrade to wger 2.6 or later.
- Monitor for unauthorized password resets or account takeovers.
- Restrict access to vulnerable wger instances.
