This blog touches base on various vulnerabilities uncovered during a pentest that was performed shortly before the app was moved to production. While not covering all the issues, we will try and cover the major findings that were uncovered and the various mitigation factors. The HOST name is REDACTED throughout this report.
Account Takeover [Critical]
By exploiting this vulnerability an adversary can take over all of the accounts in the application provided that we have info on the mobile number or email address of the user. Let’s dive deep into the exploitation:
- For the endpoint redacted.com/api/forgot_password_save , craft a payload that will allow us to change the password of any user account.
Have a look at the screenshot below for reference:
From the above screenshot, it is noted that we were able to change password for any user account by passing the updated password and the mobile number. Note the lack of authorization tokens in the request.
Mitigation:
- We have advised the client to implement strict authorization mechanisms across the application in state change functions so that no user can perform actions on behalf of other users.
- It was also recommended to implement strict validation of session tokens so that each state change functions are linked to those specified sessions of the user account and cannot be made outside of the user accounts.
OTP Leak leading to account takeover/password reset
Even though we were able to takeover accounts using the vulnerability explained earlier, there are vulnerabilities in the OTP Validation that can also lead to account takeover or feature bypass.
Have a look at the screenshot below for reference:
Once a password reset is initiated, OTP was found to be leaking in the response that can be used by the adversary to reset password/perform signup function, etc. It was also possible to manipulate this OTP to any other value and use that value instead if that is something that we are looking for.
Mitigation:
- It was recommended to remove the OTP from the response body.
- It was also advised to remove the client-side validation of the OTP so that by changing the status codes, future attacks can be prevented.
Price Manipulation
In the redacted application, there is an option to purchase access to various classes and other redacted functionalities by making certain payments. These payments unlock access to features which are paywalled. However, it was possible to manipulate these requests to purchase these at negligible amount.
Have a look at the screenshot below for reference:
From the image, it is clear that a payment of 50$ is required to unlock a feature of the application, however it was possible to change the value to 1$ to unlock the paywalled feature.
Have a look at the screenshot below:
We were able to manipulate the 50$ to 1$ and successfully pay for the feature.
This image shows that we were able to purchase the feature for 1$. The same has been reflected on the page.
Conclusion
This penetration test identified critical vulnerabilities in the mobile application that could have been exploited by attackers to take over user accounts, bypass security measures, and gain unauthorized access to premium features.
The identified vulnerabilities highlight the importance of implementing robust security practices throughout the development lifecycle. By following the recommended mitigations, such as strict authorization mechanisms, stronger OTP handling, and secure payment processing, the client can significantly improve the security posture of their application and protect their users from potential attacks.
FAQs
Account takeover (ATO) occurs when an attacker gains unauthorized access to a user’s account by exploiting security weaknesses such as broken authentication, insecure password reset mechanisms, or credential theft.
Common causes include missing authorization checks, weak session management, insecure password reset workflows, exposed OTPs, broken authentication, and improper access controls.
Password reset APIs should validate user identity and session tokens to prevent unauthorized users from changing another user’s password or taking over their account.
Exposing One-Time Passwords (OTPs) in API responses allows attackers to bypass verification processes, reset passwords, create unauthorized accounts, and compromise user identities.
Price manipulation is a business logic vulnerability where attackers modify payment-related requests to alter product prices, discounts, or transaction amounts and gain unauthorized financial benefits.
Developers should perform server-side validation of pricing, verify payment amounts independently, use secure payment gateways, and never trust client-side values for financial transactions.
Business logic vulnerabilities arise when attackers exploit flaws in an application’s workflow or transaction logic to perform unauthorized actions that bypass intended business rules.
Penetration testing simulates real-world attacks to uncover security flaws such as broken authentication, insecure APIs, business logic issues, and authorization weaknesses before they can be exploited.
Strong authentication, secure session management, server-side authorization checks, multi-factor authentication (MFA), secure OTP validation, and continuous security testing help reduce the risk of account takeover.
ValueMentor provides expert-led Mobile Application Penetration Testing services to identify critical vulnerabilities such as broken authentication, insecure APIs, business logic flaws, and payment security issues. Our assessments help organizations strengthen application security, protect user data, and reduce business risk before deployment.
