CVE-2022-0777: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 7.5
Published: 2022-03-01T09:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: config/auth.php, src/MicroweberPackages/User/routes/api.php, src/MicroweberPackages/User/routes/web.php
Commit date: 2022-02-28 11:10:32 +0200
Commit message: forgot password add throttle

Diff: diff --git a/config/auth.php b/config/auth.php
index a795d0dee7a..ede1e28a3ed 100644
--- a/config/auth.php
+++ b/config/auth.php
@@ -89,8 +89,9 @@ return [
     'passwords' => [
         'users' => [
             'provider' => 'users',
             'table' => 'password_resets',
             'expire' => 60,
+            'throttle' => 60,
         ],
     ],
 ];
diff --git a/src/MicroweberPackages/User/routes/api.php b/src/MicroweberPackages/User/routes/api.php
index 6f78cbc5f47..e323bc458ab 100644
--- a/src/MicroweberPackages/User/routes/api.php
+++ b/src/MicroweberPackages/User/routes/api.php
@@ -98,11 +98,13 @@ Route::name('api.user.')
 
     Route::post('login', 'UserLoginController@login')->name('login')->middleware(['allowed_ips','throttle:60,1']);
     Route::any('logout', 'UserLoginController@logout')->name('logout');
     Route::post('register', 'UserRegisterController@register')->name('register')->middleware(['allowed_ips']);
 
-    Route::post('/forgot-password', 'UserForgotPasswordController@send')->name('password.email');
+    Route::post('/forgot-password', 'UserForgotPasswordController@send')
+        ->middleware(['throttle:3,1'])
+        ->name('password.email');
     Route::post('/reset-password', 'UserForgotPasswordController@update')->name('password.update');
 
     Route::post('/profile-update', 'UserProfileController@update')->name('profile.update');
 
 });
diff --git a/src/MicroweberPackages/User/routes/web.php b/src/MicroweberPackages/User/routes/web.php
index 9c94b3af267..6d727fd0095 100644
--- a/src/MicroweberPackages/User/routes/web.php
+++ b/src/MicroweberPackages/User/routes/web.php
@@ -38,11 +38,13 @@ Route::namespace('\MicroweberPackages\User\Http\Controllers')->middleware(['web'
 
     Route::get('email/verify-resend/{id}/{hash}', 'UserVerifyController@showResendForm')->name('verification.resend');
     Route::post('email/verify-resend/{id}/{hash}', 'UserVerifyController@sendVerifyEmail')->name('verification.send');
 
     Route::get('/forgot-password', 'UserForgotPasswordController@showForgotForm')->name('password.request');
-    Route::post('/forgot-password', 'UserForgotPasswordController@send')->name('password.email');
+    Route::post('/forgot-password', 'UserForgotPasswordController@send')
+        ->middleware(['throttle:3,1'])
+        ->name('password.email');
 
     Route::get('/reset-password/{token}', 'UserForgotPasswordController@showResetForm')->name('password.reset');
     Route::post('/reset-password', 'UserForgotPasswordController@update')->name('password.update');
 });
 

Vulnerable code:     Route::post('/forgot-password', 'UserForgotPasswordController@send')->name('password.email');
    Route::post('/forgot-password', 'UserForgotPasswordController@send')->name('password.email');
Fixed code:             'throttle' => 60,
    Route::post('/forgot-password', 'UserForgotPasswordController@send')
        ->middleware(['throttle:3,1'])
        ->name('password.email');
    Route::post('/forgot-password', 'UserForgotPasswordController@send')
        ->middleware(['throttle:3,1'])
        ->name('password.email');