Dynamics 365 CommunityForums Microsoft Dynamics CRM (Archived) ADX Portal Password Ch...

ADX Portal Password Change - vulnerability

(0) Share

Report

Posted on by Community Member Microsoft Employee

I have inherited an ADX Portal deployed by someone else and have discovered a potential vulnerability during a password change.

ADX Portal 7.0.0021 with CRM2016 (On premise)

Once you are logged in you seems to be able go to "Password Change" page and set a new password.

On that page there is a disabled field with your username. You can quite easily set a value on that field to any other user using IE Developer Tools, Firebug etc.

This will allow you to change a password for any user as long as you know their username. You also need to have your own account so you can get to the ChangePassword page but still looks like vulnerability to me.

So I wonder if it has been addressed in any of the newer versions or if we should implement something ourselves. There is also possibility that is should not be possible and there is something wrong with our configuration so would be good to get a confirmation if that is the case.

Many thanks,

Pawel

*This post is locked for comments

All responses (2)

Answers (0)

Suggested answer

Dmytro Rutkovskyi 1,835 on at

Like (0)

Report

RE: ADX Portal Password Change - vulnerability

As well you can look to "a little bit more supported" on-prem version of the Portals whish is free and open-source here: github.com/.../xRM-Portals-Community-Edition
Allan Ho 15 on at

Like (0)

Report

RE: ADX Portal Password Change - vulnerability

Hi,

I tested what you suggested and it does not work :)

The username in the change password screen is only for display and is not sent back as apart of the password update, it is most likely tied to the CRM Contact ID bound to the user session.