{"action":"created","issue":{"url":"https://api.github.com/repos/ltb-project/self-service-password/issues/212","repository_url":"https://api.github.com/repos/ltb-project/self-service-password","labels_url":"https://api.github.com/repos/ltb-project/self-service-password/issues/212/labels{/name}","comments_url":"https://api.github.com/repos/ltb-project/self-service-password/issues/212/comments","events_url":"https://api.github.com/repos/ltb-project/self-service-password/issues/212/events","html_url":"https://github.com/ltb-project/self-service-password/issues/212","id":332348463,"node_id":"MDU6SXNzdWUzMzIzNDg0NjM=","number":212,"title":"Question regarding Waylon Grange from Stage2 Security attack","user":{"login":"cfasnacht","id":5371784,"node_id":"MDQ6VXNlcjUzNzE3ODQ=","avatar_url":"https://avatars2.githubusercontent.com/u/5371784?v=4","gravatar_id":"","url":"https://api.github.com/users/cfasnacht","html_url":"https://github.com/cfasnacht","followers_url":"https://api.github.com/users/cfasnacht/followers","following_url":"https://api.github.com/users/cfasnacht/following{/other_user}","gists_url":"https://api.github.com/users/cfasnacht/gists{/gist_id}","starred_url":"https://api.github.com/users/cfasnacht/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cfasnacht/subscriptions","organizations_url":"https://api.github.com/users/cfasnacht/orgs","repos_url":"https://api.github.com/users/cfasnacht/repos","events_url":"https://api.github.com/users/cfasnacht/events{/privacy}","received_events_url":"https://api.github.com/users/cfasnacht/received_events","type":"User","site_admin":false},"labels":[{"id":425746660,"node_id":"MDU6TGFiZWw0MjU3NDY2NjA=","url":"https://api.github.com/repos/ltb-project/self-service-password/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-14T10:44:48Z","updated_at":"2018-06-14T11:42:09Z","closed_at":null,"author_association":"NONE","body":"We received a mail:\r\n> this is an important message if you are using Self Service Password\r\n> software (https://ltb-project.org/documentation/self-service-password/).\r\n> \r\n> Waylon Grange from Stage2 Security found an attack that allows to\r\n> change user password without knowing the old password. A CVE should be\r\n> published soon.\r\n> \r\n> The code is fixed in the git repository and issues are reported here:\r\n> * https://github.com/ltb-project/self-service-password/issues/209\r\n> * https://github.com/ltb-project/self-service-password/issues/211\r\n> ...\r\n\r\n\r\nI guess this attack is only exploitable if one changes the who_change_password from default user to non default manager?\r\n"},"comment":{"url":"https://api.github.com/repos/ltb-project/self-service-password/issues/comments/397265258","html_url":"https://github.com/ltb-project/self-service-password/issues/212#issuecomment-397265258","issue_url":"https://api.github.com/repos/ltb-project/self-service-password/issues/212","id":397265258,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NzI2NTI1OA==","user":{"login":"coudot","id":883396,"node_id":"MDQ6VXNlcjg4MzM5Ng==","avatar_url":"https://avatars1.githubusercontent.com/u/883396?v=4","gravatar_id":"","url":"https://api.github.com/users/coudot","html_url":"https://github.com/coudot","followers_url":"https://api.github.com/users/coudot/followers","following_url":"https://api.github.com/users/coudot/following{/other_user}","gists_url":"https://api.github.com/users/coudot/gists{/gist_id}","starred_url":"https://api.github.com/users/coudot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coudot/subscriptions","organizations_url":"https://api.github.com/users/coudot/orgs","repos_url":"https://api.github.com/users/coudot/repos","events_url":"https://api.github.com/users/coudot/events{/privacy}","received_events_url":"https://api.github.com/users/coudot/received_events","type":"User","site_admin":false},"created_at":"2018-06-14T11:42:09Z","updated_at":"2018-06-14T11:42:09Z","author_association":"MEMBER","body":"This attack will be exploitable if the configured binddn/bindpw has enough rights to change the password of the user. The configuration of who_change_password cannot prevent the attack."}}
{"actor":{"display_login":"coudot"}}