Description
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change passwords via /api/password/update, retaining access for seven days even after the victim resets their password.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Traccar Traccar
Default version status: unaffected
0 to ≤ 6.16.0affected
pkg:github/traccar/traccarReferences
- https://hackmd.io/@haind/traccar-token-purpose-confusion ↗
- https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/signature/TokenManager.java#L47-L109 ↗
- https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/resource/PasswordResource.java#L72-L90 ↗
- https://github.com/traccar/traccar/blob/cfab560c79ee9c9eaa41c79c6df351e820d6284b/src/main/java/org/traccar/api/resource/SessionResource.java#L77-L93 ↗
- https://github.com/traccar/traccar ↗
- https://www.vulncheck.com/advisories/traccar-through-6.16.0-weak-password-recovery-via-tokenmanager-token-purpose-confusion ↗