2FA Bypass via Response Manipulation on Login Page

How it was found

Description: I discovered a vulnerability in the Two-Factor Authentication (2FA) mechanism of your website, stemming from an insecure design flaw. The issue arises from the way the system handles 2FA verification. Specifically, the verification process can be bypassed by intercepting and manipulating the server's response. As a result, an attacker can gain unauthorized access to an account after providing the correct login credentials, without the need to submit the correct 2FA code. This flaw highlights a weakness in the design of the 2FA flow, where the server fails to enforce proper security checks after the initial login phase.

References

https://hackerone.com/reports/1943252

Impact

This vulnerability allows an attacker with valid credentials (email and password) to completely bypass the 2FA mechanism. As a result:

1. The security benefit of 2FA is nullified.
2. Accounts are susceptible to unauthorized access if credentials are compromised through phishing, leaks, or other means.

System Host(s)

██████████

Affected Product(s) and Version(s)

Custom website hosted at ████████

CVE Numbers

CVE-2021-30120

Steps to Reproduce

1. Create an account at ████████
2. Log in using valid credentials (email and password) at ███████
3. A 6 digit 2FA code will be sent to your email, and you will be prompted to enter this 6 digit 2FA code
4. Enter a wrong 2FA code and make sure to intercept the response to this request
5. Observe that the intercepted response body will have a status of 3 that is status: 3 indicating an incorrect OTP code
6. Modify the status value from 3 (incorrect code) to 1 (indicating a correct code).
7. Forward the modified response and observe that you are now logged into the account, bypassing the 2FA process entirely.

Suggested Mitigation/Remediation Actions

1. Ensure that 2FA verification is fully performed server-side without relying solely on client-side or response manipulation for authentication state changes.
2. Validate the OTP server-side before granting access and ensure no client-side response or manipulation can override the server's verification logic.