119

NB: Not asking for a current password allows an attacker who has somehow hijacked current session's cookies to hijack the account as well, in direct contravention of OWASP Guideline AT-011

What security experts say about this issue:

this is pretty bad

it took me about half a minute of thinking to think of where to execute a POST request with JS while signed into SE and deny any attacked user access to his account


I decided to change my password via the my logins link, and was presented with this dialog:

Change password for XXX, new password, new password (again)

Notice the lack of confirmation of current password.

I love that I can stay logged in to Stack Exchange sites permanently, but it worries me that someone could change my password without knowing my current password.

The confirmation email says:

The password to your Stack Exchange account has been changed.
(If you didn't do this, you should be worried.)

The link is to https://openid.stackexchange.com/user so would presumably need me to be logged in there (which I wasn't) to do anything about it.


P.S. This is related to but not duplicate of Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking, with both bugs stemming from lack of defense-in-depth here.

  • 9
    (It's actually remarkably difficult to properly log out of SE under some circumstances, so that's not your fault.) – Lightness Races in Orbit May 29 '14 at 9:06
  • 13
    I'd love to see the comments in the code that emits that "If you didn't do this, you should be worried."... – Arjan Jun 1 '14 at 15:46
  • 5
    This looks like a security bug. (See owasp.org/index.php/…) – Deer Hunter Mar 2 '16 at 8:50
  • 5
    @Deer if it's really a security issue in your opinion, follow the steps described here, it might trigger a faster response from the team. (And who knows, you might see your name in the Hall of Fame ;)) – Shadow Wizard Mar 2 '16 at 9:50
  • @ShadowWizard - nah, it's not a vuln per se, and I'm not the first to discover it. Kind of a gaping lack of defense-in-depth. – Deer Hunter Mar 2 '16 at 9:56
  • 2
    For what it's worth: In my opinion, the fact that you're logged in all the time absolutely does not detract from your moral high ground at all. There's nothing wrong with being logged in all the time -- that's how the site is designed to work! – D.W. Mar 7 '16 at 7:33
  • 1
    If you're concerned by this, a very similar situation is the ability to add and remove logins without re-authenticating. I think it would be possible for a simple XSS exploit to quickly add an attack-controlled login (using a custom OpenID provider), remove the existing logins, and then permanently log the user out of their account. I've been thinking about implementing a proof-of-concept if I have some time. – Guest Mar 10 '16 at 22:05
  • 3
    @JeremyBanks - I think this should be posted as a separate issue. – Deer Hunter Mar 11 '16 at 5:02
  • 4
    @DeerHunter Done – Guest Mar 14 '16 at 19:06
  • Strange that it's been marked status-resolved without an answer saying it's been resolved. – Andrew Grimm Mar 11 '17 at 5:10
  • @AndrewGrimm Nevertheless, there's now a box for old password, and that has certainly resolved this issue. – AndrewC Mar 11 '17 at 14:38
16
+50

Thanks for bringing this up. You're absolutely right that this is a security issue, but it's been this way forever without a lot of reported problems (that's not a rationalization, I just mean to show that it isn't super pressing). The problem is only truly exploitable if we open up an XSS vulnerability on our site, or you leave yourself logged in on a public computer. In the future, we're going to try and enhance major account changing actions with re-authorization requirements, but it's very complex as we support multiple means of registration and login.

tl;dr - it's on our list, but it's not the next thing we're going to take on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .