Weak password recovery mechanism in osTicket by Enhancesoft LLC
A logic flaw in the password reset token validation allows expired tokens to be reused to compromise user accounts.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Antecedentes
osTicket by Enhancesoft LLC is a free, open-source technical support ticket management system widely used by organizations of all sizes.
Description
A logic vulnerability exists in the password reset token validation routine of osTicket versions prior to v1.17.8 and v1.18.4. The application checks whether a reset token's validity window has expired, but the expiry check is only performed if the timestamp lookup fails.
This means that tokens with existing timestamps can bypass the expiration validation entirely. The root cause is a logical operator error: the code used a logical AND (&&) when it should have used OR (||), causing the validation to fail when both conditions were not simultaneously true.
Business impact
An attacker able to obtain a valid password reset token could reuse it indefinitely to perform an unauthorised password reset and compromise the affected account. Given the critical nature of helpdesk systems that often handle sensitive customer data and internal communications, this vulnerability poses a significant risk to confidentiality and integrity.
Affected systems
osTicket versions prior to v1.17.8 and v1.18.4.
Solución
Upgrade to osTicket v1.17.8 or v1.18.4, which correct the logical operator from && to || in the token validation routine.
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-neutral provider with deep expertise since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)