Skip to main content

Authentication mechanism absence or evasion - OTP

Need​

Implementation of a secure and validated OTP (One-Time Password) authentication mechanism

Context​

  • Usage of TypeScript for type-checking and compiling JavaScript code
  • Usage of Express for building web applications and APIs

Description​

Non compliant code​

import express from 'express';

const app = express();

app.post('/register', (req, res) => {
  const { verificationCode } = req.body;

  // No validation of the verification code is performed
  // Any combination of digits is accepted

  // Register the user

  res.send('User registered successfully');
});

app.listen(3000, () => {
  console.log('Server started on port 3000');
});

The vulnerability in this code is the absence of validation for the verification code entered by the user during the registration process. The code simply retrieves the verification code from the request body without performing any validation on it. This means that any combination of digits, regardless of the specified number of digits, will be accepted as a valid verification code.

This vulnerability allows an attacker to bypass the intended authentication mechanism by entering any random code or even leaving it blank. As a result, unauthorized users can be created in the system, and an attacker can impersonate legitimate users without having to go through the proper verification process.

To mitigate this vulnerability, it is recommended to add server-side validation to ensure that the verification code entered by the user matches the one generated by the system. This can be done by comparing the entered code with the expected code and rejecting the registration if they do not match.

Steps​

  • Add a validation function to check if the verification code entered by the user matches the one generated by the system
  • Inside the validation function, compare the verification code entered by the user with the generated verification code
  • If the verification codes match, proceed with user registration
  • If the verification codes do not match, return an error response indicating that the verification code is invalid
  • Update the '/register' route handler to use the validation function before registering the user
  • Test the updated code to ensure that the verification code validation is working correctly

Compliant code​

import express from 'express';

const app = express();

function validateVerificationCode(verificationCode: string): boolean {
  // Generate the verification code using the system's logic
  const generatedVerificationCode = '123456'; // Replace with your logic to generate the verification code

  // Compare the verification code entered by the user with the generated verification code
  return verificationCode === generatedVerificationCode;
}

app.post('/register', (req, res) => {
  const { verificationCode } = req.body;

  // Validate the verification code entered by the user
  const isValidVerificationCode = validateVerificationCode(verificationCode);

  if (!isValidVerificationCode) {
    return res.status(400).send('Invalid verification code');
  }

  // Register the user

  res.send('User registered successfully');
});

app.listen(3000, () => {
  console.log('Server started on port 3000');
});

The fixed code addresses the vulnerability by implementing server-side validation of the verification code entered by the user during the registration process.

The code uses the Express framework to handle HTTP requests. It defines a POST route '/register' to handle user registration.

The function validateVerificationCode takes a verification code as input and compares it with the generated verification code using the system's logic. In this example, the generated verification code is hardcoded as '123456', but you should replace it with your own logic to generate the verification code.

Inside the '/register' route handler, the verification code entered by the user is extracted from the request body. It then calls the validateVerificationCode function to check if the entered verification code matches the generated verification code.

If the verification code is not valid, the server responds with a 400 status code and sends the message 'Invalid verification code'. This prevents unauthorized users from registering or impersonating other users.

If the verification code is valid, the server proceeds to register the user and sends a success response.

The server listens on port 3000 for incoming requests and logs a message to indicate that it has started successfully.

By validating the verification code on the server side, the fixed code ensures that only the correct verification code can be used to register a user, preventing unauthorized access and impersonation.

References​

Last updated on