Need

Implementation of a secure and validated OTP (One-Time Password) authentication mechanism

Context

• Usage of Java for building cross-platform applications
• Usage of javax.servlet for building Java web applications with Servlet technology
• Usage of javax.servlet.http for handling HTTP requests and responses in Java Servlets

Description

Non compliant code

        import javax.servlet.*;
import javax.servlet.http.*;

public class RegistrationServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String mobileNumber = request.getParameter("mobileNumber");
        String otp = request.getParameter("otp");

        // This is the vulnerable part. OTP is not validated.
        if (otp != null) {
            // Proceed with registration
            User user = new User();
            user.setMobileNumber(mobileNumber);
            // Save user to database
            // ...
            response.sendRedirect("registrationSuccess.jsp");
        } else {
            response.sendRedirect("registrationFailure.jsp");
        }
    }
}
        
        

The above code is a simple implementation of a registration process in a Java servlet. The servlet receives a POST request with the mobile number and OTP (One-Time Password) from the client.

The vulnerability lies in the doPost method where the OTP is not validated. The if (otp != null) check only verifies if an OTP value is present in the request, but it does not validate if the OTP is correct or if it has the correct number of digits.

This means that an attacker could provide any value for the OTP, even if it does not comply with the specified number of digits, and bypass the OTP authentication mechanism. This could potentially allow unauthorized users to register with any mobile number, leading to a serious security breach.

Steps

• Implement a proper validation mechanism for the OTP (One-Time Password).
• Verify that the OTP has the correct number of digits (6 digits in this case).
• Ensure that the OTP is associated with the user's mobile number.
• Consider using a secure and reliable OTP generation and validation library.
• Store the OTP securely and validate it against the user input during the registration process.
• If the OTP is invalid or does not match, handle the registration failure appropriately.
• Redirect the user to the appropriate page based on the success or failure of the registration process.

Compliant code

        import javax.servlet.*;
import javax.servlet.http.*;

public class RegistrationServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String mobileNumber = request.getParameter("mobileNumber");
        String otp = request.getParameter("otp");

        // Get the OTP associated with the mobile number from the database
        String storedOtp = getOtpFromDatabase(mobileNumber);

        // Validate the OTP
        if (otp != null && otp.equals(storedOtp) && otp.length() == 6) {
            // Proceed with registration
            User user = new User();
            user.setMobileNumber(mobileNumber);
            // Save user to database
            // ...
            response.sendRedirect("registrationSuccess.jsp");
        } else {
            response.sendRedirect("registrationFailure.jsp");
        }
    }

    private String getOtpFromDatabase(String mobileNumber) {
        // Implement this method to get the OTP associated with the mobile number from the database
        // ...
    }
}
        
        

The updated code now includes a proper validation mechanism for the OTP (One-Time Password).

Firstly, the OTP associated with the user's mobile number is retrieved from the database using the getOtpFromDatabase method. This method should be implemented to securely fetch the OTP from the database.

Next, the user-provided OTP is validated. The validation checks if the OTP is not null, matches the OTP stored in the database, and has the correct number of digits (6 digits in this case).

If the OTP is valid, the registration process proceeds. The user's mobile number is set and the user is saved to the database. The user is then redirected to the registrationSuccess.jsp page.

If the OTP is invalid or does not match the stored OTP, the user is redirected to the registrationFailure.jsp page. This ensures that the registration process is handled appropriately based on the success or failure of the OTP validation.

References

• 240. Authentication mechanism absence or evasion - OTP