# (Possible) staff account takeover via reset token bruteforce at helpdesk.bistudio.com

Helpdesk password reset verifies 6-digit SMS codes without rate limiting, letting an attacker brute-force the code and take over staff accounts.

- Payout: hidden
- Severity: critical
- Program: BOHEMIA INTERACTIVE a.s.
- Found by: europa
- Disclosed: 2018-09-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/332632
- Library page: https://bugbountylibrary.com/r/h1%3A332632
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:critical tech:rest technique:source-review vuln:account-takeover vuln:auth-bypass vuln:business-logic

**Target:** helpdesk.bistudio.com password reset and out-of-office API endpoints
**Root cause:** The SMS token verification and password-change API endpoints lack rate limiting, and the ReCAPTCHA token offered in step 1 is never validated, so the 6-digit code space can be brute-forced.
**Steps:**
1. Start reset for victim: `POST /api/system/verification-codes` with `{"username":"admin"}` to trigger SMS token generation.
2. Brute-force `GET /api/system/verification-codes/[0-9]{6}` to retrieve the victim's securityCode before the flow is cancelled.
3. Reset password: `POST /api/system/email-account/password` with `{"password":"<NEW PASSWORD>","code":"<BRUTEFORCED SMS TOKEN>","securityCode":"<RETRIEVED SECURITY CODE>"}`.
**How found:** While black-box testing the AngularJS reset flow, the researcher bypassed client-side checks by intercepting the 400 response in Burp and rewriting status to 200 and body to `"status":"ok"`, letting the applet proceed with invalid usernames/tokens; this revealed the backend endpoints were reachable and unthrottled.
**Exploitation:** Attacker initiates the reset for a target staff username, then multithreaded brute-forces the 6-digit verification-code endpoint (e.g. Burp Intruder) to obtain the securityCode, and submits the password-change request with the brute-forced SMS token and retrieved securityCode to set a new password.
**Insight:** When a client-side response rewrite lets a multi-step flow proceed, enumerate the backend endpoints it calls and test each for rate limiting independently — the UI gate (ReCAPTCHA) may not be enforced server-side.

## Proof of concept (copied exactly from the original report)

**POST to verification-codes to start reset for victim**

```
POST request to `/api/system/verification-codes` (ie: `{"username":"admin"}`). The backend generates a SMS TOKEN and sends it to the victim's phone
```

**Bruteforce verification-codes endpoint for securityCode**

```
bruteforcing `/api/system/verification-codes/[0-9]{6}` before the victim can cancel the flow (threat scenario places the attack durin night time)
```

**POST password reset with bruteforced token**

```
POST request to `/api/system/email-account/password` (ie: `{"password":"<NEW PASSWORD>","code":"<BRUTEFORCED SMS TOKEN>","securityCode":"<RETRIEVED SECURITY CODE>"}`)
```