Skip to main content

Authentication mechanism absence or evasion - OTP

Need​

Implementation of a robust and secure OTP (One-Time Password) authentication mechanism

Context​

  • Usage of C# 7.0 for modern language features and enhancements
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core MVC
  • Usage of System.ComponentModel.DataAnnotations for data validation and annotation in .NET development
  • Usage of System.Linq for querying and manipulating data in C#
  • Usage of System.Threading.Tasks for asynchronous programming in .NET

Description​

Non compliant code​

public class RegistrationController : Controller
{
    [HttpPost]
    public IActionResult Register(UserModel model)
    {
        if (ModelState.IsValid)
        {
            // Register the user
            var newUser = new User { Username = model.Username, Password = model.Password };
            _context.Users.Add(newUser);
            _context.SaveChanges();
            
            // Send OTP
            var otp = new Random().Next(100000, 999999);
            _smsService.Send(model.PhoneNumber, $"Your verification code is {otp}");

            // Redirect to OTP verification page
            return RedirectToAction("Verify", new { userId = newUser.Id });
        }
        return View(model);
    }

    [HttpPost]
    public IActionResult Verify(int userId, string otp)
    {
        // Here the OTP is not validated
        var user = _context.Users.Find(userId);
        if (user != null)
        {
            user.IsVerified = true;
            _context.SaveChanges();
            return RedirectToAction("Index", "Home");
        }
        return NotFound();
    }
}

The code above is a simplified example of a registration process in an ASP.NET Core application. Here, a user can register by providing a username, password, and phone number. After registration, a 6-digit One-Time Password (OTP) is generated and sent to the user's phone number.

The vulnerability lies in the Verify method, which is supposed to confirm the OTP entered by the user. However, the provided OTP is not checked against the one that was sent to the user. This means that any OTP, even one that doesn't match the sent OTP or doesn't comply with the 6-digit requirement, would be considered valid. As a result, an attacker could bypass this verification step by providing any OTP.

Steps​

  • Implement OTP validation logic in the Verify method to ensure that the entered OTP matches the one sent to the user's phone number.
  • Use a secure and reliable OTP generation algorithm to generate the verification code.
  • Store the generated OTP securely and associate it with the user's registration information.
  • Consider using a third-party SMS service provider that offers secure and reliable message delivery.
  • Implement rate limiting to prevent brute-force attacks on the OTP verification process.
  • Consider implementing additional security measures such as IP whitelisting or CAPTCHA to protect against automated attacks.
  • Regularly review and update the authentication mechanism to address any new vulnerabilities or emerging threats.

Compliant code​

public class RegistrationController : Controller
{
    [HttpPost]
    public IActionResult Register(UserModel model)
    {
        if (ModelState.IsValid)
        {
            // Register the user
            var newUser = new User { Username = model.Username, Password = model.Password };
            _context.Users.Add(newUser);
            _context.SaveChanges();
            
            // Generate OTP
            var otp = new Random().Next(100000, 999999);
            newUser.OTP = otp;
            _context.SaveChanges();

            // Send OTP
            _smsService.Send(model.PhoneNumber, $"Your verification code is {otp}");

            // Redirect to OTP verification page
            return RedirectToAction("Verify", new { userId = newUser.Id });
        }
        return View(model);
    }

    [HttpPost]
    public IActionResult Verify(int userId, string otp)
    {
        // Validate the OTP
        var user = _context.Users.Find(userId);
        if (user != null && user.OTP == otp)
        {
            user.IsVerified = true;
            _context.SaveChanges();
            return RedirectToAction("Index", "Home");
        }
        return NotFound();
    }
}

The updated code now includes OTP validation in the Verify method. When a user registers, an OTP is generated and stored in the user's record in the database. This OTP is then sent to the user's phone number.

When the user enters the OTP on the verification page, the Verify method retrieves the user's record from the database and compares the entered OTP with the stored OTP. If the OTPs match, the user's account is marked as verified and the user is redirected to the home page. If the OTPs do not match or if the user's record cannot be found, the method returns a NotFound result.

This update addresses the vulnerability by ensuring that the entered OTP matches the one sent to the user's phone number, thereby preventing authentication mechanism evasion. It also uses a secure and reliable OTP generation algorithm to generate the verification code and stores the generated OTP securely.

Additional security measures such as rate limiting, IP whitelisting, or CAPTCHA can be implemented to protect against brute-force or automated attacks. Regular reviews and updates of the authentication mechanism can also help to address any new vulnerabilities or emerging threats.

References​

Last updated on