22

✏️ Editing: 1735084331.M962411P1209338.node93.myfcloudin.com,S=8707,W=8869:2,c

Envelope-to: info@autozone.com.sa
Delivery-date: Tue, 24 Dec 2024 23:52:11 +0000
MIME-Version: 1.0
From: Balaj Faisal <balajfaisaal@gmail.com>
Date: Wed, 25 Dec 2024 04:51:00 +0500
Message-ID: <CAL=8e2+V+xku1Vewgo1uyAw+0SOaq43fLfkCbpYV=Ym-pAEk8A@mail.gmail.com>
Subject: Vulnerability Report-Broken Authentication
To: info@autozone.com.sa
Content-Type: multipart/alternative; boundary="00000000000043ece0062a0cca38"

--00000000000043ece0062a0cca38
Content-Type: text/plain; charset="UTF-8"

Hey Team,

I'm a penetration tester and bug bounty hunter. I have discovered multiple
vulnerabilities on your site. I've reported one of my findings so that you
can review it, as well as fix this issue.

Please review the report below.

Vulnerability: Broken Authentication & Session Management
We have observed that when we change "password" from one browser in place
of session expiration from another browser it just updates the password
from another browser and the old session gets updated without being logged
out. The flows goes like this:
Broken Authentication and Session Management > Failure to Invalidate
Session > On Password Change
Steps:
1- Login from two browsers at a time [From Chrome browser and from Mozilla
Firefox].
2- Change password in settings from chrome browser.
3- Now Check Mozilla Firefox.
4- Your Session got "updated" in place of expiration.

Same goes with when using two different computer systems.
1- Login from two computers at a time
2- Change password in settings from computer A.
3- Now Check computer B.
4- Your Session got "updated" in place of expiration.

Recommendations: If Session is Updating from one Browser/Computer so other
should expire first to renew session after login.

If you require any additional information, please let me know. I'll be
waiting to hear from your side regarding the report and bounty. I'll share
my other findings as well, once I've heard back from you.

Regards,
Balaj Faisal

--00000000000043ece0062a0cca38
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hey Team,<br><br>I&#39;m a penetration te=
ster and bug bounty hunter. I have discovered multiple vulnerabilities on y=
our site. I&#39;ve reported one of my findings so that you can review it, a=
s well as fix this issue.<br><br>Please review the report below.<br><br>Vul=
nerability: Broken Authentication &amp; Session Management<br>We have obser=
ved that when we change &quot;password&quot; from one browser in place of s=
ession expiration from another browser it just updates the password from an=
other browser and the old session gets updated without being logged out. Th=
e flows goes like this:<br>Broken Authentication and Session Management &gt=
; Failure to Invalidate Session &gt; On Password Change<br>Steps:<br>1- Log=
in from two browsers at a time [From Chrome browser and from Mozilla Firefo=
x].<br>2- Change password in settings from chrome browser.<br>3- Now Check =
Mozilla Firefox.<br>4- Your Session got &quot;updated&quot; in place of exp=
iration.<br><br>Same goes with when using two different computer systems.<b=
r>1- Login from two computers at a time<br>2- Change password in settings f=
rom computer A.<br>3- Now Check computer B.<br>4- Your Session got &quot;up=
dated&quot; in place of expiration.<br><br>Recommendations: If Session is U=
pdating from one Browser/Computer so other should expire first to renew ses=
sion after login.<br><br>If you require any additional information, please =
let me know. I&#39;ll be waiting to hear from your side regarding the repor=
t and bounty. I&#39;ll share my other findings as well, once I&#39;ve heard=
 back from you.<br><br>Regards,<br><div>Balaj Faisal</div></div></div>

--00000000000043ece0062a0cca38--

MR SKB