e-mail verification bypass through interception & modification of response status

How it was found

Hi,

During registration of account at https://tams.preprod.gsa.gov, e-mail verification (code validation) can be bypassed through intercepting & modifying the response status-from "success":false to "success":true Video {F1284281} is for reference.

Steps To Reproduce

1. Open User Registration Url - https://tams.preprod.gsa.gov/userEmailReg
2. Enter the email & submit.
3. Prompt to enter the verification code will appear.
4. Enter any wrong value (6 digits), submit & capture in burp. 5.Before submitting, select the option in burp - Do Intercept response to this request
5. After receiving the response. Modify the value false to true for success parameter.
6. You would be able to continue the registration process.
7. A pop up appears in the next stage. You can close & go ahead with registration process.

Impact

Bypass of e-mail verification processes.