CVE-2020-26061

Vulnerability

The ClickStudios Passwordstate Password Reset Portal prior to build 8501 (version 8.5) is affected by an authentication bypass vulnerability [2]. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. This allows an unauthenticated, remote attacker to send a crafted HTTP request to the /account/ResetPassword page to set a new password for any registered user [2].

Exploitation

An attacker needs no prior authentication or network position beyond HTTP access to the Passwordstate instance [2]. The exploitation involves sending a crafted HTTP POST request to the /account/ResetPassword endpoint with parameters specifying the target username and desired new password. The server fails to enforce the security question authentication step, processing the request as valid [2].

Impact

Successful exploitation allows the attacker to change the password of any registered user, leading to unauthorized account access [2]. This can result in exposure of sensitive credentials stored in Passwordstate, privilege escalation if the compromised account has administrative rights, and further compromise of systems managed using those credentials.

Mitigation

The vulnerability was fixed in Passwordstate version 8.5 build 8501, released on October 12, 2018 [2]. Users should update to this build or later. No workaround is documented in the available references [2]. If the software is end-of-life and cannot be updated, consider restricting network access to the Password Reset Portal or disabling it entirely.