Password Reset Token Hijacking in Authorizer

Executive Summary

This vulnerability is a password reset poisoning issue in Authorizer versions before 2.4.2. It allows unauthenticated attackers to manipulate the host of emailed password reset or magic-link URLs by injecting malicious x-authorizer-url gRPC metadata or headers. Attackers can send this metadata to the gRPC port or via a Grpc-Metadata-X-Authorizer-Url header through the REST gateway, causing victims to receive links pointing to attacker-controlled hosts. This enables token capture and account takeover.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Authorizer instance is running a version before 2.4.2. Use commands like 'curl -s https://your-authorizer-url/version' or inspect the running container image tag. Monitor network traffic for suspicious headers like 'X-Authorizer-Url' or 'Grpc-Metadata-X-Authorizer-Url' targeting ports 9091 (gRPC) or REST gateway ports.

Useful 0 Not Useful 0

Impact Analysis

If you use Authorizer versions before 2.4.2, attackers could trick you into clicking malicious password reset links. These links would appear legitimate but point to attacker-controlled servers, allowing them to capture your reset tokens and take over your account. This requires SMTP to be configured and you to follow the link.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Authorizer to version 2.4.2 or later immediately. Ensure the --url parameter is set and enforced across all transports. Block or monitor the 'X-Authorizer-Url' header at your network perimeter. Verify no unauthorized password reset or magic-link emails are being sent to external domains.

Useful 0 Not Useful 0