1721714 - Missing session checks at 2FA leading to improper session management in BMO (bugzilla.mozilla.org)

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect)

Description

[Aryan Sinha]

Summary:

Even after resetting the password remotely, the user already presented with the 2FA page is allowed to log in with the old password of the BMO account.

Impact:

Improper session management

Repro Steps:

Setup: 2FA enabled BMO account

1. Go to bugzilla.mozilla.org and enter the credentials. You will be presented with 2FA page which will ask you to enter the 2FA code. Do not enter the code at this moment.

2. From another browser/device, go to bugzilla.mozilla.org and initiate the reset password process for the BMO account, and reset the password successfully for the given BMO account.

3. Come to the previous browser/device where you were presented with the 2FA page and enter the valid 2FA code. You will be successfully logged in.

Any session created with an older password should get terminated right after the password reset.

Comment 1

[:glob ✱]

Marking as sec-low as this requires existing credentials.

Comment 2

[David Lawrence [:dkl]]

Attachment: 1721714_1.patch

Comment 3

[:glob ✱]

Comment on attachment 9232692 [details] [diff] [review]
1721714_1.patch

Review of attachment 9232692 [details] [diff] [review]:
-----------------------------------------------------------------

r=glob

Comment 4

[David Lawrence [:dkl]]

Merged to master. Will be live today.

Comment 5

[David Lawrence [:dkl]]

This change is now live.

Comment 6

[Aryan Sinha]

(In reply to David Lawrence [:dkl] from comment #5)

This change is now live.

Hi David,

I re-tested the same and can confirm that the vulnerability has been fixed.

As I have never been rewarded with bounty by Mozilla, I am unsure about the process. Is this report eligible for the bounty, as I believe so? If yes, how much time does it usually takes to reward a bounty?

Thanks, in advance! Much appreciate a quick fix.

Comment 7

[David Lawrence [:dkl]]

(In reply to Aryan Sinha from comment #6)

I re-tested the same and can confirm that the vulnerability has been fixed.

Good

As I have never been rewarded with bounty by Mozilla, I am unsure about the process. Is this report eligible for the bounty, as I believe so? If yes, how much time does it usually takes to reward a bounty?

I am not involved with that process so I will needinfo someone who might be able to help.

Comment 8

[Daniel Veditz [:dveditz]]

It looks like you filed this bug using the bounty form, so it has all the metadata needed to make it into the bounty committee's queue. The bug is not marked "fixed" yet, though. Dave: does comment 5 mean this should be resolved FIXED, or is there something else we're waiting on?

Comment 9

[David Lawrence [:dkl]]

(In reply to Daniel Veditz [:dveditz] from comment #8)

It looks like you filed this bug using the bounty form, so it has all the metadata needed to make it into the bounty committee's queue. The bug is not marked "fixed" yet, though. Dave: does comment 5 mean this should be resolved FIXED, or is there something else we're waiting on?

It is fixed and deployed. Wasn't sure about closing this bug though as the security bounty decision was still ongoing. Feel free to close.

Comment 10

[Aryan Sinha]

(In reply to David Lawrence [:dkl] from comment #9)

(In reply to Daniel Veditz [:dveditz] from comment #8)

It looks like you filed this bug using the bounty form, so it has all the metadata needed to make it into the bounty committee's queue. The bug is not marked "fixed" yet, though. Dave: does comment 5 mean this should be resolved FIXED, or is there something else we're waiting on?

It is fixed and deployed. Wasn't sure about closing this bug though as the security bounty decision was still ongoing. Feel free to close.

Hi Daniel, as I can see :glob has now changed the status to Resolved, Fixed. How much time does it take usually after this to hear about the bounty decision from the team?

Thanks a ton in advance!

Comment 11

[Daniel Veditz [:dveditz]]

bounty questions should generally be directed to [e-mail]: the developers in a bug don't know the answers, and the bug bounty team won't see the questions in the bug until something triggers a re-check (usually a status change like being marked FIXED, or the bug showing no activity for a while). We try to meet weekly, but in summer we sometimes can't get a quorum due to vacations and skip a week here and there.

Comment 12

[Daniel Veditz [:dveditz]]

Thank you for reporting this. We don't believe this would be a realistic attack scenario, but we appreciate the opportunity to fix this race condition.