Skip to main content

Lack of data validation - OTP

Description

There is no evidence of validation of the values sent in the tokenCode parameter to complete the request, allowing random values to be used in multiple attempts.

Impact

Perform the account creation process without knowing the generated token.

Recommendation

  • Validate on the server side that the token sent by the user is the one generated for the request.
  • Validate that the token generated is used only once.

Threat

External attacker authenticated.

Expected Remediation Time

⌚ 90 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 4.3
    • Temporal: 4.3
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

The user session expires in case an incorrect token is used

exports.signin = (req, res) => {
const token = req.body.tokenCode;
const isValidToken = validateusertoken(req.body.user, token);
if isValidToken{
//Handle user signin
}else{
//If the token is not valid, the user session must be closed and redirected to the sign in
res.redirect("user/login");
}
}

Non compliant code

The application includes functionality that allows multiple token codes to be send without ending the user session

exports.signin = (req, res) => {
const token = req.body.tokenCode;
const isValidToken = validateusertoken(req.body.user, token);
if isValidToken{
//Handle user signin
}else{
return res.message("Invalid Token. Try Again")
}
}

Requirements