TduckPro Arbitrary Password Reset Vulnerability Analysis

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Name: [Vulnerability] Arbitrary Password Reset in All Versions of Tduckpro 2. Vulnerability Description: TduckPro is a commercial form survey system developed by Hunan Zhongda Shuwei Information Technology Co., Ltd. Versions 2.0 to 6.3 (all current versions of TduckPro) contain a vulnerability that allows resetting the password for any account ID (including administrator accounts) without knowing the original password. 3. Exploit Title: Arbitrary Password Reset in All Versions of Tduckpro 4. Sodan: http.html:tduck backend management framework 5. Date: September 3, 2024 6. Vulnerability Author: ShawRoot 7. Vendor Homepage: https://www.tduckcloud.com/ 8. Software Link: The system is commercial software and not open source. 9. Version Range: 2.0 <= TduckPro <= 6.3 10. Test Platform: Windows 11. POC: - Due to the commercial nature of the platform, no open-source code is available, and no local reproduction environment exists. Therefore, all vulnerability reproduction efforts were conducted on platforms with open registration capabilities. - Specific steps include registering two low-privilege accounts and attempting to perform password change operations. The results show that the operation allows resetting the password for any ID, including administrator accounts (id=1). - Validation was performed using the official demo environment, which implements an auto-stop policy with a validity period of 72 hours. - By logging into the "vul1" account, navigating to "Personal Information" → "Basic Information" → "Save", and checking the browser's F12 console, the ID of the "vul1" account was determined to be 8372. - Log in to the "vul2" account, modify personal information, ensuring that the phone number and email fields do not modify existing data in the database. Then, change the "ID" field to the ID of the "vul1" account, set "Username" and "Nickname" fields to "vul1", and set "Email" and "Phonenumber" fields to email addresses not existing in the database. - Upon logging back into the "vul1" account, the password was found to have been changed. 12. Remediation Recommendation: Apply user access restrictions to the personal information update API, ensuring that users cannot modify information for other IDs without proper authorization. This information provides a detailed description of the exploitation process and remediation recommendations, which is crucial for security researchers and developers.

Goal Reached Thanks to every supporter — we hit 100%!

TduckPro Arbitrary Password Reset Vulnerability Analysis