120

NB: Not asking for a current password allows an attacker who has somehow hijacked current session's cookies to hijack the account as well, in direct contravention of OWASP Guideline AT-011

What security experts say about this issue:

this is pretty bad

it took me about half a minute of thinking to think of where to execute a POST request with JS while signed into SE and deny any attacked user access to his account

I decided to change my password via the my logins link, and was presented with this dialog:

Change password for XXX, new password, new password (again)

Notice the lack of confirmation of current password.

I love that I can stay logged in to Stack Exchange sites permanently, but it worries me that someone could change my password without knowing my current password.

The confirmation email says:

The password to your Stack Exchange account has been changed.
(If you didn't do this, you should be worried.)

The link is to https://openid.stackexchange.com/user so would presumably need me to be logged in there (which I wasn't) to do anything about it.

P.S. This is related to but not duplicate of Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking, with both bugs stemming from lack of defense-in-depth here.

Improve this question
11
  • 9
    (It's actually remarkably difficult to properly log out of SE under some circumstances, so that's not your fault.)
    – Lightness Races in Orbit
    Commented May 29, 2014 at 9:06
  • 14
    I'd love to see the comments in the code that emits that "If you didn't do this, you should be worried."...
    – Arjan
    Commented Jun 1, 2014 at 15:46
  • 5
    This looks like a security bug. (See owasp.org/index.php/…)
    – Deer Hunter
    Commented Mar 2, 2016 at 8:50
  • 5
    @Deer if it's really a security issue in your opinion, follow the steps described here, it might trigger a faster response from the team. (And who knows, you might see your name in the Hall of Fame ;))
    – Shadow Wizard
    Commented Mar 2, 2016 at 9:50
  • @ShadowWizard - nah, it's not a vuln per se, and I'm not the first to discover it. Kind of a gaping lack of defense-in-depth.
    – Deer Hunter
    Commented Mar 2, 2016 at 9:56
  • 2
    For what it's worth: In my opinion, the fact that you're logged in all the time absolutely does not detract from your moral high ground at all. There's nothing wrong with being logged in all the time -- that's how the site is designed to work!
    – D.W.
    Commented Mar 7, 2016 at 7:33
  • 1
    If you're concerned by this, a very similar situation is the ability to add and remove logins without re-authenticating. I think it would be possible for a simple XSS exploit to quickly add an attack-controlled login (using a custom OpenID provider), remove the existing logins, and then permanently log the user out of their account. I've been thinking about implementing a proof-of-concept if I have some time.
    – Jeremy
    Commented Mar 10, 2016 at 22:05
  • 3
    @JeremyBanks - I think this should be posted as a separate issue.
    – Deer Hunter
    Commented Mar 11, 2016 at 5:02
  • 4
    @DeerHunter Done
    – Jeremy
    Commented Mar 14, 2016 at 19:06
  • 1
    Strange that it's been marked status-resolved without an answer saying it's been resolved.
    – Andrew Grimm
    Commented Mar 11, 2017 at 5:10
  • 1
    @AndrewGrimm Nevertheless, there's now a box for old password, and that has certainly resolved this issue.
    – AndrewC
    Commented Mar 11, 2017 at 14:38

1 Answer 1

Reset to default
17
+50

Thanks for bringing this up. You're absolutely right that this is a security issue, but it's been this way forever without a lot of reported problems (that's not a rationalization, I just mean to show that it isn't super pressing). The problem is only truly exploitable if we open up an XSS vulnerability on our site, or you leave yourself logged in on a public computer. In the future, we're going to try and enhance major account changing actions with re-authorization requirements, but it's very complex as we support multiple means of registration and login.

tl;dr - it's on our list, but it's not the next thing we're going to take on.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .