5500$ Bug Story - Ezzy 2FA Bypass
Summary:
A payment application requires 2FA verification by your number and email both when editing user details including name, email or phone number. I found an easy bypass for the implemented 2FA flow through which an attacker can edit the user details without his phone/email access that finally leads to an account takeover.
Steps to Reproduce:
- Go to Edit section, start editing the email field.
- 2FA prompt will ask you for an OTP on current email.
- Enter the wrong OTP "123456". Intercept the response.
- Change response from
{"success":"false"}to{"success":"true"}. - 2FA prompt will again ask you for an OTP on current phone number.
- Enter the wrong OTP "123456". Intercept the response.
- Change response from
{"success":"false"}to{"success":"true"}. - Prompt will ask you to enter email to be changed, input attacker email here.
- Enter the OTP that came in your email inbox.
- Refresh the dashboard, email changed.
Why It Happened?
Generally, after 2FA verification (1st HTTP request) a token is assigned and this token will be used with email change request (2nd HTTP request). Here, no such token was sent when entering OTP (in 1st HTTP response). This is a common case to check in case of multi-stage actions.
Reporting Timeline
10 May 2023 - Reported via Hackerone
11th May 2023 - Status changed to Triaged
7th June 2023 - Retest completed 50$ and Resolved
10th June 2023 - 5000$ reward + 500$ bonus
Author: Inderjeet Singh
Hackerone: https://hackerone.com/encodedguy
Twitter: https://twitter.com/3nc0d3dGuY
Happy Hacking!!