Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-5594

CVE-2017-5594: Pagekit Weak Password Recovery Mechanism for Forgotten Password

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2017-5594
GHSA ID
GHSA-rp89-32rp-qpq2
EPSS Score
0.92406%
CWE
CWE-640
Published
5/13/2022
Updated
4/24/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
pagekit/pagekitcomposer< 1.0.111.0.11

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key issues in password reset flow: 1) requestAction generated and stored activation tokens before completing email delivery, exposing them via debug toolbar. 2) confirmAction relied solely on URL parameters without session binding, allowing token reuse. The patch added session-based state tracking (App::session()->set('activation')) and moved key generation after email sending. The exploit script demonstrates attackers could harvest reset tokens from debug endpoints, which were available due to these flawed functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in P***kit *MS ***or* *.*.**. In t*is vuln*r**ility t** r*mot* *tt**k*r is **l* to r*s*t t** r**ist*r** us*r's p*sswor*, w**n t** ***u* tool**r is *n**l**. T** p*sswor* is su***ss*ully r**ov*r** usin* t*is *xploit. T** S**ur*L

Reasoning

T** vuln*r**ility st*ms *rom two k*y issu*s in p*sswor* r*s*t *low: *) `r*qu*st**tion` **n*r*t** *n* stor** **tiv*tion tok*ns ***or* *ompl*tin* *m*il **liv*ry, *xposin* t**m vi* ***u* tool**r. *) `*on*irm**tion` r*li** sol*ly on URL p*r*m*t*rs wit*ou