2FA bypass possible on https://authsvc.singlestore.com

How it was found

Summary:

To exploit this vulnerability and break into the victim's account, the attacker only needs to know the email address and password of the victim's account. The 2FA authentication mechanism can be bypassed completely.

Steps To Reproduce:

• Firstly, enter the victim's account e-mail address and password at https://portal.singlestore.com/ and click login.
• Then make a fake 2FA code attempt, intercept the request in Burp and do not send the request in Burp, leave Intercept on.
• Then, send the request you caught to the intruder, tick the code next to the mfaToken parameter. Then, mark the Payload type as Number. For example, if the 2FA code sent to your e-mail address is 156289, enter a value between 155900 and 1556300 so that the brute force does not take too long. Then press the start attack button.
• Observe the transition from status code 303 to 302 at the end of the attack. Since the 2FA mechanism was developed incorrectly, as a result of the 3rd incorrect attempt, it switches from an HTTP status code of 200 to a status code of 302 and returns you to the beginning of the login process, but you can still try the request via Burp, and when you make a correct 2FA attempt, including subsequent attempts, it switches to a status code of 302 and you are logged into the account in the browser.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/CR:H/IR:H/AR:H

Impact

This vulnerability makes it possible to completely bypass the 2FA mechanism developed to protect victims from malicious attacks when logging into their account