Vulnerability Report: Lack of Rate Limiting in Forget Password Functionality

Summary:

During a security assessment of the authentication system on https://app.hoory.com/, a lack of rate limiting was discovered in the "Forget Password" functionality. This vulnerability allows an attacker to potentially launch brute force or automated attacks on user accounts, leading to unauthorized access.

Vulnerability Details:

Endpoint: The forget password functionality can be accessed via the URL https://app.hoory.com/auth/password.

Absence of Rate Limiting: Upon inspection of the request and response traffic, it was observed that there is no rate limiting mechanism implemented for the "Forget Password" feature. This means that an attacker could programmatically send numerous password reset requests without encountering any restrictions.

Potential Impact:

Credential Guessing: Attackers could leverage this vulnerability to guess user passwords through automated or brute force methods.

Account Takeover: Successful exploitation of this vulnerability could lead to unauthorized access to user accounts, potentially compromising sensitive information stored within the application.

Reputational Damage: The exploitation of this vulnerability could result in reputational damage for the organization, as users may lose trust in the security of the platform.

Recommendations:

Implement Rate Limiting: Introduce rate limiting mechanisms to restrict the number of forget password requests that can be made within a certain time period. This can help mitigate the risk of brute force attacks.

Monitoring and Logging: Implement robust monitoring and logging mechanisms to track forget password requests and detect suspicious patterns indicative of brute force attacks.

User Notifications: Notify users of any forget password requests made on their accounts, allowing them to take appropriate action if they did not initiate the request.

Security Awareness: Educate users about the importance of choosing strong, unique passwords and utilizing additional security measures such as multi-factor authentication.