an attacker can impersonate another user mobile number and use this vulnerability to verify the number without knowing the OTP code.
Attack Type
- Remote (Authenticated)
Affected Versions
- Versions before <= 8.6.8
Vendor of Product
- Ascertia
Affected Product Code Base
- SigningHub
Affected Component
- Mobile number verification function.
Mitigations
- Revoke the OTP code if a number of attempt passed certain value.
Vulnerability Details
- The application does not enforce proper rate limiting on the One-Time Password (OTP) verification endpoint. This allows an attacker to automate and brute-force OTP codes without restriction. By sending a high volume of OTP guesses in rapid succession, an attacker can potentially bypass the OTP verification mechanism of the mobile number.
Fixed versions
- Versions after > 8.6.8
Discovered By:
- Yazan Abu-Nadi