CareMonkey SaaS BB #1 - Token Reset Vulnerability

Document Title:
===============
CareMonkey SaaS BB #1 - Token Reset Vulnerability 


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1873

Video: http://www.vulnerability-lab.com/get_content.php?id=1926


Release Date:
=============
2016-06-02


Vulnerability Laboratory ID (VL-ID):
====================================
1873


Common Vulnerability Scoring System:
====================================
6.4


Product & Service Introduction:
===============================
CareMonkey for Schools is a mobile health and safety solution that gives authorised teachers and carers instant access to 
important medical and emergency contact details when an incident occurs. CareMonkey makes life easier for families, teachers 
and administrators and is used by pre-schools, primary schools, secondary schools and Universities around the world.

(Copy of the Homepage: https://www.caremonkey.com/schools/ )


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a session token vulnerability in the CareMonkey SaaS web-application.


Vulnerability Disclosure Timeline:
==================================
2016-03-09 Researcher Notification & Coordination (Lawrence Amer)
2016-03-15 Vendor Response/FeedBack (CareMonkey Security Team)
2016-03-25 Vendor Fix/Patch (CareMonkey Developer Team)
2016-04-04 Vendor Acknowledgments (CareMonkey Security Team)
2016-06-02 Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
CareMonkey Pty Ltd
Product: CareMonkey SaaS - Web Application 2016 Q2


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
A reset user/customer password web vulnerability has been discovered in the  CareMonkey SaaS main core web application.
The vulnerability allows an attacker to bypass the account system functions for account take-over or unauthorized access.

Remote attackers are able to get the current token, which is responsible for resetting the current password of an user
account or caremonkey customer account. The vulnerability occurs in the sms token validation process. The reset token 
is leaked through validation response when processing to intercept. The vulnerable request method is POST and the 
vulnerable parameter[Reset_password_token] is responsible for providing the current validation by the basic password 
reset session.

The security risk of the vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.4. 
Exploitation of the reset user/customer password web vulnerability requires a low privileged web-application user account 
and low or medium user interaction. Successful exploitation of the vulnerability results account system manipulation via 
reset token validation process.

Request Method(s):
[+] POST

Vulnerable Module(s):
[+] Password Reset Verify (/passwords/verify_sms_token)
						
Vulnerable Parameter(s):
[+] Reset_password_token


Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers without privileged web-application user account or user interaction.
For security demonstration or to reproduce the web vulnerability follow the provided information and steps below to continue. 

Manual steps to reproduce the vulnerability ...
1. First the remote attackers moves to reset account password via sms 
2. GET/POST requests are being intercepted through http interception or session tamper
3. The current password reset token is leaked through passwords module 
4. Attackers can use the formal argument to reset the password of any user depending on knowledge of the USERID
Note: https://groups.caremonkey.com/users/password/edit?reset_password_token=[TOKEN]&user_id=[UserID]
5. Successfully reproduce of the vulnerability!


PoC: Video
https://youtu.be/j7-8YyYdWL4


Security Risk:
==============
The security risk of the session token reset vulnerability in the web-application is estimated as high. (CVSS 6.4)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Lawrence Amer [http://www.vulnerability-lab.com/show.php?user=Lawrence%20Amer]



Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, 
including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, 
including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised 
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com 		- www.vuln-lab.com 						- www.evolution-sec.com
Section:    magazine.vulnerability-lab.com 	- vulnerability-lab.com/contact.php 				- evolution-sec.com/contact
Social:	    twitter.com/vuln_lab		- facebook.com/VulnerabilityLab 				- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	- vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically 
redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or 
its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific 
authors or managers. To record, list, modify, use or edit our material contact (admin@ or [email protected]) to get a ask permission.

				    Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™