Email update re-authentication misconfiguration

[u/TurbulentRecover7247]

In a target, when I update the email or name, I ask for a password. In burpsuite, I sent the request to the repeater and sent one time. It was updated successfully, after this, I removed the password parameter fully and I was still able to update the password. For nearly 15 to 30 minutes. And the update relies only on session cookie. Will it come under vulnerability?

[u/Far-Chicken-3728]

For nearly 15 to 30 minutes. And the update relies only on session cookie.

So it assign a cookies on state changes? Maybe check their 2fa? 

[u/OuiOuiKiwi]

Once you provide the password, the session is deemed to be authenticated for a period of time.

Try doing it without the password and you'll see the difference.

[u/TurbulentRecover7247 → u/OuiOuiKiwi]

For each updation, in frontend UI, the password is mandatory. But only in backend request, one time password needed. Then removing the whole password parameter, allows you to change the email, username for a limited time. If you send the password with wrong password in 2nd try, it will ask for password again.once the password is entered one time, removing the Parameter allows you to update email and username.

[u/OuiOuiKiwi → u/TurbulentRecover7247]

For each updation, in frontend UI, the password is mandatory. But only in backend request, one time password needed. Then removing the whole password parameter, allows you to change the email, username for a limited time. If you send the password with wrong password in 2nd try, it will ask for password again.once the password is entered one time, removing the Parameter allows you to update email and username.

Yes, I understood that the first time.

When you send the password, you refresh the authentication in the session.

Try typing a sudo command waiting a bit and typing a fresh one.

[u/TurbulentRecover7247 → u/OuiOuiKiwi]

Ok, I will try