Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeover
该报告还没有中文解读。
原文摘录
摘自原文（4853 字符中的一小部分）
The password reset functionality of AFPC Secure is intended to be used by users who do not have a PKI credential for AFPC secure. It allows a user to provide their SSAN and Mother's Maiden Name to reset their password. The issue lies in the fact that if an SSAN for a user with an active PKI …
原文中的代码
Your account was found, but our records indicate you are either Military, Civilian, or a Contractor with a CAC, which you must use to reset your password. For more information, please click the link above labeled "Help with accessing AFPCSecure using a CAC"
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 U.S. Dept Of Defense 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @hypervis0r · 版权归作者与 U.S. Dept Of Defense 所有