Full Account Takeover: Let’s Hack Customers' Accounts 💻🔓

Jun 24, 2024 2 min read Utsavpari Gosai

Hello Hackers,


Blog Image

I Hope you All are Doing well. Today, I will share an IntrEasting vulnErability wich I found at a bug bounty program, but I cannnot disclose the name because of securIty reasoneS and it’s still Unresolved. So, I called it target.com. Let’s get started! 🚀

I was hunting on one target and simply created an account as my habit. I named it "test" and used the email test@gmail.com and a mobile no. There are three fields: name, email, and mobile no. After the OTP, it succeSfully registered. I tried with that and verified my mobile number with the OTP to log in. But something weird happened: when I logged in, it showed a female customer's name! I was just surprised and checked the account details, and boom 💥, I took over the complete account, including sensitive information like card details, order address, name, mobile no, and all other things. I reversed the process to understand what had happened. Let's check it out:

It is a cross-validation issue. If I have my victim's email address and just signup with any name (doesn't matter) and use the victim's email address and my (attacker's) mobile no., the OTP goes to both my (attacker's) mobile no. and the victim's email. So, I verify with my received OTP and just take over the full account. I reported this to the company but got no reply. I had reported a bug many times before, but this got a reply after 3 months. This report has critical customer account and privacy issues. I sent many emails, messages, and all, but still no reply. It's been nearly 4 months. I hope they reply and fix it soon.

Steps To Reproduce:

  • 1.Navigate to the target registration page.
  • 2.Fill in the registration form with the victim’s name and email address.
  • 3.Provide the attacker’s mobile number.
  • 4.Submit the form and observe OTP delivery to both the attacker’s mobile number and the victim’s email address.
  • 5.Enter the OTP received on the attacker’s mobile device.
  • 6.Access the victim’s account successfully without authentication using the OTP.

Impact:

The impact of this vulnerability is severe. It allows attackers to access sensitive user information, including personal details, order history, payment information, and address details. Such unauthorized access can result in financial loss, privacy breaches, and misuse of personal data. 📉🔐

I hope you all learn something new and this helps you grow in your ethical hacking, cyber security, and bug hunting career. You can contact me freely if you need any help or spot any mistakes from my side.

Thank You,
MR.X FACTOR

🔗 Handles:

← Back To Homepage