Password Reset Token Lifetime Misconfiguration in Gogs

Executive Summary

This vulnerability affects Gogs, an open source self-hosted Git service, in versions prior to 0.14.3. The issue is that password-reset tokens are generated using the account-activation token lifetime setting (conf.Auth.ActivateCodeLives) instead of the intended password-reset token lifetime setting (conf.Auth.ResetPasswordCodeLives). Because the token lifetime is embedded in the token at creation and checked during verification, the configured shorter reset token lifetime is ignored. As a result, reset tokens remain valid for the longer activation lifetime, even if the administrator configures a shorter reset window for security or compliance reasons. This means the reset tokens can be exploited for longer than intended, while the reset email incorrectly states a shorter expiry time.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing password-reset tokens to remain valid for a longer period than intended, potentially exposing user accounts to unauthorized access. Even if administrators set a short expiration time for reset tokens to enhance security, the tokens will actually be valid for the longer account-activation lifetime. This discrepancy can lead to exploitation where attackers use expired tokens that should have been invalidated, increasing the risk of account compromise.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Gogs to version 0.14.3 or later, where the issue with password-reset token lifetime enforcement is fixed.

Ensure that the configuration for password-reset token lifetime (conf.Auth.ResetPasswordCodeLives) is properly enforced after the upgrade.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes password-reset tokens to remain valid for a longer period than intended when administrators configure a shorter reset window for compliance or security reasons. As a result, reset tokens can be exploited for the full activation lifetime instead of the shorter reset lifetime advertised in reset emails.

Because the reset token lifetime enforcement does not align with configured policies, this could undermine compliance efforts with standards and regulations such as GDPR or HIPAA that require strict control over authentication and password reset mechanisms to protect user data and privacy.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves password-reset tokens in Gogs versions before 0.14.3 being valid for the full account-activation lifetime instead of the configured shorter reset-password lifetime. Detection involves verifying the token generation and validation behavior in your Gogs instance.

To detect if your system is vulnerable, you can attempt to request a password reset and observe the token's actual validity period compared to the advertised expiry time in the reset email.

There are no specific network commands provided in the resources, but you can perform the following steps:

• Request a password reset for a test account.
• Capture the reset token from the email.
• Attempt to use the token after the advertised expiry time but within the default activation lifetime (e.g., after 10 minutes but before 180 minutes).
• If the token is still accepted, your system is vulnerable.

For automated detection, you might consider inspecting the Gogs source code or configuration files to check if the version is prior to 0.14.3 and if the token generation uses conf.Auth.ActivateCodeLives instead of conf.Auth.ResetPasswordCodeLives.

Useful 0 Not Useful 0