mall-portal Unauth Verification Code Leak and Account Takeover via /sso/getAuthCode Logic Flaw

[Security Vulnerability] Combination of and Leads to Arbitrary Member Account Takeover #1 Vulnerability Overview Vulnerability Description: - The password reset flow in has a logical flaw: 1. returns the verification code directly to the requester; 2. allows password reset using only , without requiring a login session or the original password; 3. If an attacker knows the target username, they can log in directly with the new password and complete the account takeover. - In other words, knowing only the target's phone number is sufficient to reset the password; if the username is also known, the target account can be logged into directly. Affected Endpoints: - - - Related Code: - - Basis for Default Open Access to Endpoints: - These endpoints are configured as open (no login required) by default in the current project. - The whitelist in permits . - in allows access. Impact: - Unauthorized reset of passwords for any member account. - Direct takeover of member accounts when the username is known. - Further access to sensitive user data such as personal information, orders, addresses, and phone numbers. Reproduction Information Target URL: Target Phone Number: Target Username: Reproduction Steps Step 1: Verify Current Password Status First, verify that the target account can currently log in with the password : Response: Then, verify that login fails with the incorrect password : Response: This indicates that before exploitation, was not the current password for this account. Step 2: Obtain Verification Code Using Only Phone Number Response: This shows that the server returns the verification code directly to the requester. An attacker only needs to know the phone number to obtain the code required for password reset. Step 3: Reset Password Directly Using Phone Number + Verification Code Response: This demonstrates that a password reset can be performed without a login session or the original password, relying solely on . Step 4: Successful Login with New Password Response: At this point, it is confirmed that the attacker has successfully changed the target account's password and can log in directly with the new password. The final result of the vulnerability is the complete takeover of the member account. Root Cause returns the verification code directly in the response, rendering the code ineffective as a second factor of authentication. lacks effective identity verification, allowing password reset based solely on the phone number and verification code. Vulnerable Code Locations 1. Verification Code Returned Directly to Client Here, is returned directly as response data. An attacker only needs to know the phone number to obtain the verification code. 2. Password Reset Endpoint Relies Only on Phone Number and Verification Code The endpoint itself does not require a login session or the original password. 3. Server Side Directly Modifies Password Based on Phone Number Here, it is evident that the server identifies the target account via and directly changes the password after the verification code is validated. 4. Verification Code Validation Relies Only on Phone Number The verification code is bound to the phone number. Since the verification code itself is returned directly by the endpoint, this password reset mechanism can be directly exploited by attackers.

Goal Reached Thanks to every supporter — we hit 100%!

mall-portal Unauth Verification Code Leak and Account Takeover via /sso/getAuthCode Logic Flaw

More from this source