Information Disclosure

Vulnerability

The Lost Password functionality in OTRS (Community Edition 5.0.41 and prior, 6.0.26 and prior; OTRS 7.0.15 and prior) accepts wildcard characters in the Token value when processing password reset requests [1]. This allows an attacker to bypass the token validation mechanism and retrieve valid tokens generated by users who previously requested a password change [1].

Exploitation

An unauthenticated attacker with network access to the OTRS instance can craft Lost Password requests containing wildcards in the Token parameter [1]. By sending such requests, the attacker can enumerate or retrieve valid tokens generated by other users who have requested password resets [1]. The attacker does not require any prior authentication or user interaction, though the attack complexity is considered high due to the need to craft the request appropriately [1].

Impact

Successful exploitation leads to unauthorized disclosure of password reset tokens (confidentiality impact) and potentially allows the attacker to reset passwords for other users, leading to unauthorized access (integrity impact) [1]. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) indicates high confidentiality impact and low integrity impact, with a base score of 6.5 (MEDIUM) [1].

Mitigation

Fixed versions are available: OTRS 7.0.16, OTRS 6.0.27, and OTRS 5.0.42 (Community Edition) [1]. Patches are provided via GitHub commits for Community Edition 6.0.x and 5.0.x [1]. Users should upgrade to the latest fixed version or apply the provided patches. No workaround is disclosed in the advisory [1].