Predictable password reset token may lead to account takeover in countly-server

Vulnerability

In Countly server, prior to versions 22.03.7 (new UI) and 21.11.4 (old UI), the password reset token generation is predictable. The token was derived using a SHA-512 hash of the concatenated username and full_name fields stored in the database, along with a timestamp [1]. An attacker who knows an account's email address/username and full name can compute the same token and use it to reset the victim's password without any further authentication [2].

Exploitation

An attacker must first obtain the victim's email address (or username) and full name as stored in Countly's database. With these details, the attacker can compute the SHA-512 hash of username + full_name using any known timestamp (or brute-force a small window of timestamps) to generate the password reset token. The token is used in the password reset endpoint to set a new password and gain access to the victim's account [1][2].

Impact

Successful exploitation leads to a complete account takeover. The attacker can log in as the victim, access any analytics data, and perform any actions the victim is authorized to do, resulting in full compromise of the victim's Countly account [2].

Mitigation

The vulnerability is patched in Countly Server version 22.03.7 for servers using the new user interface, and version 21.11.4 for servers using the old user interface [2]. The fix replaces the predictable derivation with a cryptographically secure random token (crypto.randomBytes(32).toString('hex')) [1]. No workarounds other than upgrading to the patched versions are provided.