Microsoft Password Reset Portal Can Leak Account Verification Details
Microsoft’s password-reset portal can be used to identify valid user accounts and, in some cases, reveal their registered password-reset verification methods without requiring authentication, according to research from LevelBlue SpiderLabs shared with Hackread.com.
The finding involves Microsoft’s public Self-Service Password Reset (SSPR) portal, a legitimate service that allows users to recover forgotten passwords without contacting their organization’s helpdesk. SpiderLabs found that the portal’s responses can provide attackers with useful reconnaissance information before they attempt to compromise an account.
Password Reset Portal Reveals Account Details
Researchers found that submitting an email address to the SSPR portal produces different responses depending on whether the account exists. A valid account can advance to the verification stage, while an invalid address produces a different response. The distinction can also be identified through a hidden CurrentViewName field returned by the portal.
Responses such as SSPR_0011 and SSPR_0013, which indicate policy restrictions or group exclusions, can...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
