A bug chain to steal funds from users wallet

  hello guys,

While looking at some web pen test project i saw a simple reset password flow.The user receives a reset password code via phone number. It's a  four numbers pin and no rate limit was implemented.You can just guess what's going to happen.

so a user could just ask for reset code, input new password and code on the reset password page and if the code is correct the password is changed. I sent the request to burp intruder with my new password and bruteforced for the codes.With 4 number pins we have 10,000 possible combinations.

After a few minutes i saw longer response and  200 ok status. Clicking on the response i was greeted with password changed successfully message. Hurrah!!!

Account Takeover is fine but what about stealing funds from some wallets.

I checked the withdraw feature and started playing with  the request. The request was in json format so i remembered albinowax tweet on json interoperability vulnerabilities by bishopfox labs.you can read more here:https://labs.bishopfox.com/tech-blog/an-exploration-of-json-interoperability-vulnerabilities

I tried almost all the tricks in that blog but nothing worked except adding  my  number  in the second parameter in this format.

phone number:{"wallet phone number","my phone number"}: }

The parser was parsing second parameter as legitimate request.checking my number i received the money.

You could be asking yourself why the title stealing funds.how can we get users details?

1.with a simple user enumeration vulnerability on sign up page stating if a user exists or not.An attacker could bruteforce phone numbers with a wordlist.

2.there was an IDOR on profile page leaking all users information

with the IDOR an attacker could  just query anyones balance,phone numbers and look for promising targets being people with great balances.

so now i can query users information via IDOR or user enumeration then login in to any account via ATO , transfer the money to my phone number via json interoperability bug in few minutes.