A token not bound to the account

Labs need a computer

Open this page on a computer, or make the browser window larger.

Loading the lab.

Scenario

The reset token is issued for your guest account, but when resetting, the server only checks that the token is valid, not that it belongs to the account you reset. So you request a token for yourself, then reset admin with it.

What you are looking at

A reset page that requests a token for your guest account and shows it, then a form where you pick the account, token and password. The server does not bind the token to the account it was issued for.

Goal

Reset admin with a token issued for your guest account.

What counts as solved

You reset admin with a guest token.

Method checklist

Tick each step as you work through it. The steps are the method, not the answer.

Request a token for your guest account.
Note the token is valid in general.
Choose the admin account with the guest token.
Reset and confirm it succeeds on admin.

Hints

You have not revealed a hint yet. Ask the falcon when you need one.

Why the solution worked

The token was not bound to the account it was issued for, so any valid token resets any account. The fix is binding the token to the account id and checking the match on reset.

The root cause

The server checks the token is valid, not that it is bound to the account. The root is the missing token-to-account binding.

How the code is fixed

Bind the reset token to the account id and verify the match on reset.

Vulnerable code

if (validTokens.has(req.body.token)) resetPassword(req.body.user); // user not checked

Safe code

const owner = tokenOwner.get(req.body.token);
if (owner && owner === req.body.user) resetPassword(owner); // token bound to its account

Impact in the real world

An unbound token lets the attacker reset any account with their own token, a full takeover.

How defenders detect it

Defenders bind the token to the account, check the match, and alert on resets using a token issued for a different account.

Back to the lesson