E-Arogya

OTP Bruteforce (Repeated)
CWE : CWE-799
Description :
Application allows users to submit multiple wrong OTPs which lead to bruteforce
attacks to guess the correct OTP.
Affected Path(s) :
https://earogya.satragroup.in/login *-Applicable to entire application
Impact :
Account takeover can be possible by using this vulnerability.
Evidence/Proof Of Concept :
Step 1: Application accepting multiple OTP requests which leads to brute force the OTP by
submitting multiple requests.

Step 2: Functionalilty issue

Recommendation :
It is recommended to allow only 3 to 5 wrong attempts of OTPs. After the limit block the
mobile number for some time or provide a new OTP.