2FA Bypass due to Improper Server-side Validation

Описание: Timeline:
Reported: Wed, 8 Mar 2023
Fixed: Sat, 11 Mar 2023

Info: In this case, the target application is failing to properly validate the presence and correctness of the 2FA code on the server side. While the client-side (browser) enforces the 2FA code entry by disabling the Login button when the 2FA field is empty, the server does not properly enforce this requirement. By intercepting and modifying the request to remove the 2FA code, the server mistakenly allows the login to proceed without a valid 2FA code, thus bypassing the second factor of authentication.