How I Bypassed 2FA by Mutating My Profile Phone Number in Graphql Request

How a simple phone number update in Graphql request compeletly bypassed 2fa protection and gave full account control.

| وَكَانَ فَضْلُ اللَّهِ عَلَيْكَ عَظِيمًا

The story

2FA protection was impelemented as the secondary shield if your credientials were compromised.!. 2FA is that you have ex. sms otp , email otp , fingerprint , masterkey , …etc. so being vulnerable put your account and sensitive data into danger.

That’s the underlying 2fa flow , if 2fa enabled then an OTP (one time password) will be prompted and wait for entering the code received , That’s the normal flow, and that exactly was impelemented by the app. But a misconfiguration and a gap between authentication provider and application graphql api lead to full bypass.

Discovery

while i was hunting on a target let’s call app.example.com ( respecting it’s disclosure policy) , as i prefer the manual hunting , i started surfing the application , looking for functionalities , mapping the structure and understand the busniess flow , after hours of zero summation , i came to the profile update page , notice that the request send via graphql , i tried some known exploits , misconfiguration ex. introspection, … etc ended with no thing , that’s was properly configured.

Then i came across the 2fa i enabled it and logged out , then logged in , 2fa triggered and asked for code enter

i tried response manipulation but not worked as another tokens was required to be valid session. so i say that let’s check burp history to approach the flow , i noticed the primary session was issued by third-party integrated service, so I thought what if there a misconfiguration into integration between two different services , so i came to the factor that 2fa relies on that was phone number. How can i change the phone number to my own , remember graphql profile update request ?!

i gave it a try i used pre-2fa issued JWT and craft the request to /graphql and my surprise , response 200 OK and the phone were changed.

i updated with phone number under my control , and it was accepted , i then returned to 2fa page require code then clicked resend code and that was send to my new updated phone number, i then used the code to enter.

i entered the application , 2fa compeletly bypassed…

The problem

• A misconfigured / forgotten sensitive function like graphql , that was able to update phone number at which the otp code will be sent. That accept non-compeleted authentication token ( primary/preauth token ).
• In addition to non restriction of phone update , no another security layer or verification caused the phone changed easily.

Both lead to attacker ability bypass 2fa.

Impact

• 2FA is rendered entirely ineffective as a security control
• phone number can be replaced before MFA is verified, giving the attacker persistent access even after the victim attempts recovery
• No victim interaction required attacker needs only valid credentials
• Target stores highly sensitive business data including employee schedules, payroll information, and HR records — all exposed upon account takeover

Responsible Disclosure & reward

I wrote the report and recorded the POC , and send to them via their reporting portal. It was classified as High (P2)

Thanks for your reading … Have a nice day.