B2C Service Platform
Identifying a Critical eKYC Vulnerability in a B2C Service Provider
Background
During a grey box penetration test, our team discovered a critical vulnerability in a B2C service provider’s login and eKYC authentication flow. This flaw allowed an attacker to bypass identity verification and gain unauthorized access to a user’s account by manipulating session tokens.
The Process
- Creating a Legitimate Account (User B)
- Our pentester first created a new customer account (User B), completed the eKYC process using a valid face scan and national ID, and intercepted the first login token issued during this session.
- This token, intended for User B, became the key to a more profound vulnerability.
- Intercepting Sensitive Data
- Next, the tester logged in with User A's credentials, which had been provided as part of the grey box test.
- It’s worth noting that, in the real world, such credentials are often compromised via social engineering, phishing, or black-market leaks.
- During login, we intercepted the POST request to the login API and found it leaked sensitive personal information—including User A’s National Citizen ID and PII—in the response payload.
- Token Injection Attack
- The tester modified the intercepted login request by injecting the first token from User B's session into User A’s login attempt.
- As a result, the system believed the session belonged to User A, but the token was associated with User B’s verified session.
- This misalignment in session handling effectively bypassed the eKYC process.
- Full Account Takeover
- The tester then received a second authentication token from the system and was granted full access to User A’s account, with a successful 200 OK response.
- On the surface, the interface showed a normal login flow—while in reality, an impersonation had just occurred.
Lessons Learned & Remediation
The test revealed a severe session validation flaw and poor handling of sensitive data in API responses. Immediate steps were taken:
- The API was redesigned to enforce proper token/session validation.
- Additional checks were added to ensure session integrity between tokens and user identities.
- Sensitive data was removed from all login responses.
This case reinforces the importance of rigorous session management and API security validation, especially in systems involving eKYC and personal identity data.
Want to find the flaws before attackers do? Let us test your system.
