Authentication Bypass in AIP-PUB ACPs-community

Executive Summary

This vulnerability is in the AIP-PUB ACPs-community project up to version 2.2.0. The /auth/verify-code endpoint returns the SMS verification code directly in the HTTP response instead of sending it via SMS. An unauthenticated attacker can request a code for any phone number and use it to log in or reset passwords, taking over accounts.

Useful 0 Not Useful 0

Detection Guidance

Check if the /auth/verify-code endpoint is exposed and returns verification codes in HTTP responses. Use tools like curl to send a POST request to the endpoint with a test phone number and inspect the response for a 'code' field. Example: curl -X POST http://target-server/auth/verify-code -d '{"phone":"1234567890"}'

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full access to your account, including read/write access to agents and organization data. They could operate within the platform using your account's CLIENT role by exploiting the exposed verification code.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to obtain verification codes for any phone number, enabling account takeover. This could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the development mode that exposes verification codes in API responses. Implement rate limiting on the /auth/verify-code endpoint. Ensure verification codes are sent exclusively via SMS and never included in HTTP responses. Remove or gate the shortcut behind a test-only switch rejected in production.

Useful 0 Not Useful 0