Skip to main content

Lack of data validation - OTP

Need​

Implementation of data validation for OTP tokenCode parameter

Context​

  • Usage of Python 3.0+ for developing Python applications
  • Usage of Django for building web applications

Description​

Non compliant code​

from django.http import HttpResponse
from django.views import View

class VerifyOTPView(View):
    def post(self, request, *args, **kwargs):
        tokenCode = request.POST.get('tokenCode')

        # Assuming there is a function that verifies the OTP
        if verify_otp(tokenCode):
            return HttpResponse('OTP Verified Successfully')
        else:
            return HttpResponse('Invalid OTP', status=400)

This is a simple Django view that handles POST requests to verify OTP (One-Time Password). The OTP token code is retrieved from the POST data with the key 'tokenCode'. This code is then passed to the verify_otp function, which is assumed to handle the OTP verification process.

The vulnerability lies in the fact that there is no validation of the tokenCode parameter before it is passed to the verify_otp function. This means that an attacker could potentially send multiple requests with random values for 'tokenCode', in an attempt to guess a valid OTP. This is known as a brute force attack.

A lack of rate limiting or other security measures could allow an attacker to make unlimited guesses at the OTP, increasing their chances of guessing correctly. This could lead to unauthorized access to user accounts or other sensitive information.

Additionally, without proper validation, the verify_otp function could be susceptible to other types of attacks, such as SQL Injection, if the OTP codes are stored in a database and the function includes unsafe database queries.

Steps​

  • Implement input validation for the 'tokenCode' parameter to ensure it meets the expected format and length.
  • Limit the number of attempts a user can make to verify an OTP within a certain time frame to prevent brute force attacks.
  • Implement a time-based OTP (TOTP) which will automatically expire after a certain period.
  • Use a secure method to generate the OTP, ensuring it is random and unpredictable.
  • Ensure the OTP is securely transmitted and stored.

Compliant code​

from django.http import HttpResponse
from django.views import View
from django.core.cache import cache
import time
import re

class VerifyOTPView(View):
    def post(self, request, *args, **kwargs):
        tokenCode = request.POST.get('tokenCode')
        user_id = request.user.id

        # Validate the OTP format
        if not re.match("^[0-9]{6}$", tokenCode):
            return HttpResponse('Invalid OTP format', status=400)

        # Limit the number of attempts
        attempts = cache.get(f'otp_attempts_{user_id}', 0)
        if attempts >= 5:
            return HttpResponse('Too many attempts, please try again later', status=429)

        # Assuming there is a function that verifies the OTP
        if verify_otp(tokenCode):
            cache.set(f'otp_attempts_{user_id}', 0)
            return HttpResponse('OTP Verified Successfully')
        else:
            cache.incr(f'otp_attempts_{user_id}')
            return HttpResponse('Invalid OTP', status=400)

The updated code includes several security measures to prevent brute force attacks and ensure the OTP is valid:

  1. Input Validation: The re.match() function is used to validate the format of the OTP. It checks if the OTP consists of exactly 6 digits. If the OTP does not match this format, a 400 response is returned with the message 'Invalid OTP format'.

  2. Limiting Attempts: The number of OTP verification attempts is limited to 5 per user. This is achieved by using Django's cache framework. The cache stores the number of attempts made by each user. If a user exceeds the limit, a 429 response is returned with the message 'Too many attempts, please try again later'.

  3. Resetting Attempts: If the OTP verification is successful, the number of attempts for the user is reset to 0.

  4. Secure OTP Verification: The verify_otp() function is assumed to be a secure method for OTP verification. It should generate a random, unpredictable OTP, transmit it securely, and store it securely. It should also implement a time-based OTP (TOTP) which will automatically expire after a certain period.

By implementing these measures, the vulnerability related to the lack of data validation for the OTP is addressed.

References​

Last updated on