API4:2023 — Unrestricted Resource Consumption

Slide 16 · Scenario 3

One user. One million OTP texts. One giant SMS bill.

OWASP Scenario #3 — no rate limit on OTP delivery lets an attacker invoice you for SMS.

📄 OWASP API Security Top 10 · 2023 · API4 · Scenario 3

SETUP

A login API that sends SMS one-time passwords.

A web application uses SMS-based OTP for login verification. The endpoint POST /api/auth/send-otp accepts a phone number and sends a verification code. Each SMS costs the company approximately $0.01 through their SMS provider.

The endpoint has no rate limiting per phone number and no rate limiting per IP address.

The exploit — financial attack: An attacker sends 100,000 requests to this endpoint with the same phone number (or a rotating list of real numbers). The company's SMS provider bills 100,000 sends at $0.01 each — $1,000 overnight. At 1,000,000 requests: $10,000. The attacker spent nothing. The company's SMS account may also be suspended for unusual volume, breaking OTP delivery for legitimate users.

SECONDARY EFFECT

SMS flooding as harassment.

The attacker supplies a victim's phone number. The victim receives hundreds of OTP texts per hour — effectively a denial of service against their phone. If the company has no rate limit per phone number, there is no technical barrier to this.

Two fixes required: Rate limit per requesting IP (stop bulk submissions) AND rate limit per phone number (stop a target from being flooded regardless of how many IPs the attacker uses).

← Back What do all these have in common? →