Authy, a Twilio Inc. product, is a service that aims to better protect data online with two-factor authentication. But the researchers at Sakurity have come up with a vulnerability that lets you bypass 2-Factor Authentication for Authy by just typing in something as simple as "../sms" keyword in the token field. According to the researchers, the attacker can bypass 2-factor authentication on any website whether it's Google, Facebook, Twitter or any other. But nothing to worry now as the researchers successfully reported the vulnerability and it has been fixed.

Sakurity reported this after their general audit of Authy app for Android, iOS, Blackberry and Windows, and found the 2FA Provider to be Highly Vulnerable to Format Injection vulnerability.

In fact the root of the problem was default Sinatra dependency rack-protection! - the report stated.

With their ongoing Application API Audit, they first found the Authy-Python to be vulnerable. But soon they realized that every API is vulnerable as the URL encoding used by Authy was futile.

"...path_traversal module in rack-protectionwas decoding %2f back to slashes! This literally affects every API running Sinatra and reading parameters from the path", reads the report.

Steps to Bypass 2-Step Verification

1. The attacker types ../sms in the SMS token field
2. The client app encodes it as ..%2fsms and makes an API call to Authy
3. Path_traversal middleware decodes path
4. Actual Authy API sees modified path, simply sends another SMS to authy_id (the victim) and responds with 200 status
5. All Authy SDK libraries consider 200 status as a successful response and let the attacker in.

Technical Details

There are 2 API Calls in Authy:

1. The client requests new token:http://api.authy.com/protected/json/sms/AUTHY_ID?api_key=KEY where AUTHY_ID is publicly available identifier associated with current user account. Expected response: {"success":true,"message":"SMS token was sent","cellphone":"+1-XXX-XXX-XX85"} with 200 status.
2. The user sends the token back and the client verifies if the token is valid withhttp://api.authy.com/protected/json/verify/SUPPLIED_TOKEN/AUTHY_ID?api_key=KEY and authenticates with second factor if API responds with 200 status (body is ignored): {"success":true,"message":"Token is valid.","token":"is valid"}

The Loophole: Authy-node does not encode token from user params.

For more Technical Details you can visit the report page.

About Format Injection Vulnerability

Format Injection is not a new bug, but it was never described as a subclass of A1 Injection. The idea is very similar to SQL injections but instead of breaking quotes ' with user input and changing the query, we are breaking custom delimiters /:|,;& and changing the signed data.