I was surfing a website, http://www.99acres.com, few days back and tried to retrieve my password using “Forgot Password” page. As I entered my username, I was amazed to see my email address shown there. I, then, tried another name such as “karthik” and following was the message:“An email has been sent to email@example.com. Please click on the link provided in the email to create a new password.”Take a look at the screenshot below as an evidence of the vulnerability.
As 99acres.com is one of the India’s largest retail website, one could easily write an automated script and retrieve email addresses of millions of users and then, use different techniques to retrieve few passwords as well.
The solution is pretty simple. The response message could look like following:
“An email has been sent to your registered email address. Please click on the link provided in the email to create a new password.”
He has also authored the book, Building Web Apps with Spring 5 and Angular.
Latest posts by Ajitesh Kumar (see all)
- AWS SNS Example with Spring Boot & Java - March 20, 2018
- Spring Boot & Angular 5 PWA Dev Environment Setup - March 18, 2018
- How-to Tutorials for Spring Security OAuth2 & REST API - March 18, 2018