# CSRF - Add optional two factor mobile number

Slack's 2FA SMS enrollment endpoint ignored the CSRF crumb token, letting an attacker add their phone as a 2FA device and bypass 2FA on the victim's account.

- Payout: $500
- Severity: high
- Program: Slack
- Credited: nhavis
- Disclosed: 2016-08-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/155774
- Library page: https://bugbountylibrary.com/r/h1%3A155774
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:high tech:email technique:chained vuln:account-takeover vuln:csrf vuln:mfa-bypass

**Target:** /account/settings/2fa_sms 2FA mobile enrollment endpoint
**Root cause:** Server did not validate the existence or value of the 'crumb' CSRF token parameter on the 2FA SMS enrollment endpoint, so cross-origin POSTs were accepted.
**Steps:**
1. Craft HTML page with hidden form POSTing to `https://<workspace>.slack.com/account/settings/2fa_sms` with `verify_two_factor=1&backup=&app=&primary_phone_number=<attacker>&country_code=AU&phone_number=<attacker>` (no crumb)
2. Auto-submit form via JS to add attacker's phone as 2FA device
3. Load attacker-controlled script that returns the SMS code to the victim page
4. Submit second form with `backup=1&formatted_phone_number=<attacker>&confirmation_code=<code>` to verify the number
5. Attacker logs in with victim's password and requests 2FA code sent to their own phone
**How found:** Researcher noticed the 2FA SMS enrollment request included a 'crumb' CSRF token and tested removing it; server accepted the request without it, revealing missing CSRF validation.
**Exploitation:** Attacker lures logged-in victim to malicious page; hidden iframe forms silently enroll attacker's phone number and verify it using the SMS code relayed via attacker's server; attacker then logs in with known password and receives the 2FA code on their own device.
**Escalation:** Chains CSRF with a live SMS-code relay to complete verification in seconds, converting a CSRF into full 2FA bypass/account takeover for anyone holding the password.
**Insight:** Test 2FA/MFA enrollment and recovery endpoints specifically for missing CSRF tokens — these are often overlooked versus login flows, and a CSRF there converts a stolen password into full ATO by adding an attacker-controlled second factor.