3 ms·
There's not much detail but how would they gain access from a password reset if they didn't have access to the email account? And if they had email access then
by manigandham 6y ago
There's not much detail but how would they gain access from a password reset if they didn't have access to the email account? And if they had email access then they already have everything.
The reset via admin tools must have bypassed the normal email workflow.
- SifJar 6y agoAdmin tools used to change account email address to one attacker controlled, then password reset requested which now sends to the attacker controlled email address
- manigandham 6y agoThen that's the vulnerable bypass. Changing the email is effectively changing the identity attached. It's akin to an account recovery and should require several verification steps before it can be done.