Bypass 2FA Using Status Code Manipulation

Hello, my name is Muhammad Daffa, in this post I want to share about a vulnerability that I found on a private program

First, when I’m login to the website, it requires an OTP code to go to the dashboard, in this case, I’m using random OTP code to test the website. The request will look like this:

POST /api/2fa/verify-code/ HTTP/1.1
Host: site.com
[...]
{"code":"12345","remember_me":false}

And the response looks like this

HTTP/1.1 404 Not Found
[...]
{"status":"Wrong code"}

But if I am inputting the right OTP code, the response will look like this

HTTP/1.1 200 OK
[...]
{"id":"111111111-aaaa-dddd-fffff-xxxxxxxxxx","code":"123456"}

And then I’m thinking, how about I change the response code in the response? So when I intercept the request, I am intercepting the response too. So, from 404 Not Found, I change the status code to 200 OK. The response will look like this

HTTP/1.1 200 OK
[...]
{"status":"Wrong code"}

And suddenly I logged in to my account without using the right OTP code. Quickly I reported it to the company and I was rewarded with $$$

That’s it for this writeup from me, I hope you guys enjoying it.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store