CVE-2023-33291
📋 TL;DR
This vulnerability in ebankIT 6 allows unauthenticated attackers to generate OTP (One-Time Password) messages to arbitrary email addresses or phone numbers via public endpoints. It affects ebankIT 6 installations with exposed public endpoints, but cannot target registered users' contact information.
💻 Affected Systems
- ebankIT Digital Banking Platform
📦 What is this software?
Ebankit by Ebankit
⚠️ Risk & Real-World Impact
Worst Case
Attackers could flood unregistered email addresses/phone numbers with OTP messages, causing denial-of-service through spam, potentially leading to service disruption or reputational damage.
Likely Case
Spam attacks targeting random email/phone numbers, wasting system resources and potentially triggering rate limiting or alert fatigue.
If Mitigated
Minimal impact if endpoints are properly secured with authentication or request validation.
🎯 Exploit Status
Exploitation requires only HTTP requests to public endpoints; no authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.ebankit.com/digital-banking-platform
Restart Required: No
Instructions:
Check vendor advisory for updates; implement input validation and authentication on affected endpoints.
🔧 Temporary Workarounds
Restrict Public Endpoint Access
allBlock or restrict access to /public/token/Email/generate and /public/token/SMS/generate endpoints using firewall rules or web application controls.
Implement Rate Limiting
allApply rate limiting to OTP generation endpoints to prevent abuse and spam attacks.
🧯 If You Can't Patch
- Implement network segmentation to isolate ebankIT systems from untrusted networks.
- Deploy web application firewall (WAF) rules to block malicious requests to OTP endpoints.
🔍 How to Verify
Check if Vulnerable:
Send HTTP POST requests to /public/token/Email/generate and /public/token/SMS/generate with arbitrary email/phone parameters; check if OTP generation succeeds without validation.Check Version:
Check ebankIT administration interface or documentation for version information.Verify Fix Applied:
Test endpoints again; requests should fail or require proper authentication/validation.📡 Detection & Monitoring
Log Indicators:
- Unusual volume of requests to OTP generation endpoints
- Requests with non-registered email/phone parameters
Network Indicators:
- High traffic to /public/token/* endpoints from untrusted sources
SIEM Query:
source_ip NOT IN trusted_networks AND uri_path CONTAINS '/public/token/' AND count > threshold