Grab · Report #205000
Authorization bypass using login by phone option+horizontal escalation possible on Grab Android App
Summary
Summary
I found a OTP code bypass on the login endpoint, used by Grab Android App. Since no password was required upon login (only SMS code), it was actually account takeover (still, the victim will be informed that something is wrong because of few incoming SMSes with codes). The team was very responsible and fixed the issue fast. Thanks to the Grab team for the great experience and the bounty! It is a pleasure to work with you!
Technique
The used method (thanks to the @yaworsk and his #149598 report!) is highly depending on the luck due to low enough chance to guess correct code using only 3 attempts in 30 seconds (and we must consider that the server may not throw the one of the choosen codes for a very long time). So account takeover is not so easy, and requires a lot of time. The side effect of this - it is abusing the SMS sending mechanism (it was fixed too).
Why it works
- The code had only 4 digits (with 5-6 digits chance to guess the code dramatically drop). Even with 4 digits tool can work a week without results. and
- There was no limiting on the code refreshing attempts (now it is, and also account can be locked).
Used tools and apps:
- Nox App Player (android emulator), proxied through web debugging proxy.
- Tested application - https://play.google.com/store/apps/details?id=com.grabtaxi.passenger (app allows registration from any country)
- Custom C# tool for SMS code refreshing.
How it was found
Description:
After my previous report about 2FA bypass on the Profile Edit endpoint i was interested to find enpoint, which will allow me horizontal privileges escalation.
So, I found the endpoint using android app https://p.grabtaxi.com/api/passenger/v2/profiles/activationsms which allow me to bypass OTP code due to lack of rate limiting.
The root cause of the problem it that facts: resend code endpoint do not have rate limiting (it has only 30 seconds timing for resending possibility). But code activation on the https://p.grabtaxi.com/api/passenger/v2/profiles/activate has 3 attempts limit, then it will be expired.
Combined this two facts, i found that it is possible to succeed in the account takeover of any user using only phone number.
Method: we have only 3 code attempts, and we can reset the code every 30 seconds without rate limiting.
This gave us 6 attempts in the minute, 360 attempts in the hour, and 8640 attempts in 24 hour. Since codes range has only 9999 values (it is 4-digit), we will likely succeed with the correct code in the 24-72 hours.
Attacker just need to choose some 3 custom OTP codes, for example, 1056, 1057, 1058, and start trying to send them every 30 seconds. If all 3 codes will fail - reset it and try again in next 30 seconds. Sooner or later, Grab Server will throw some of this codes, and this code will be accepted, and we will have access to the victim's account. How it looks in the Web Debugger - you can see on the screenshot attached (test.png).
Example report, where used similar method: https://hackerone.com/reports/149598
Impact
The attacker can bypass OTP verification on Grab android app on any mobile number using "Login with mobile number" option. Attacker can succeed in the account takeover of any user without any privileges, using only phone number and country code.
Steps To Reproduce:
- Use my POC tool, attached to the report (written on C#, requires .NET 4.0). Sources included.
- Enter your test phone number to the field (it must starts with country code without
+and be the connected to the Grab account on Android app) - or you can use my test number███and press Start. - Tool will start sending 3 code attempts
1056, 1057, 1058and refreshing the code in case of failing every 30 seconds. The process may take many hours, but sooner or later you will receive message with success response and session header.
Mitigation/Remediation Steps:
I suggest you implement a rate-limiting on this endpoint https://p.grabtaxi.com/api/passenger/v2/profiles/activationsms, for example, blocking code resending for some time after 5 or more resends.