eBankIT 6 Arbitrary OTP Generation

CVE-2023-33291

[Description]
In eBankIT 6, the public endpoints /public/token/Email/generate and
/public/token/SMS/generate allow generation of OTP messages to any email
address or phone number without validation.

---

[Additional Information]
The cookies in the request are not needed, they can be empty.

---

[Vulnerability Type]
Insecure Permissions

---

[Vendor of Product]
eBankIT

---

[Affected Product Code Base]
eBankIT - Version 6

---

[Affected Component]
Public API Endpoint: /public/token/Email/generate
Public API Endpoint: /public/token/SMS/generate

---

[Attack Type]
Remote

---

[Impact Denial of Service]
true

---

[CVE Impact Other]
Because these endpoints are public, and the values of the cookies are not
required, a threat actor could potentially leverage this functionality to
create a more realistic social engineering scenario that could potentially
affect clients.

---

[Attack Vectors]
To exploit this vulnerability, an attacker must intercept the request to
the api public endpoint: /public/token/Email/generate or
/public/token/SMS/generate. The attacker can modify the parameters to
choose which email or phone number the OTP would go to. This request can be
used without any type of restriction.

---

[Discoverer]
Steeven Rodríguez