diff --git a/submissions/description/insufficient_security_configurability/no_two_fa/guidance.md b/submissions/description/insufficient_security_configurability/no_two_fa/guidance.md index 908ac9f2..ee88d9d2 100644 --- a/submissions/description/insufficient_security_configurability/no_two_fa/guidance.md +++ b/submissions/description/insufficient_security_configurability/no_two_fa/guidance.md @@ -2,4 +2,4 @@ Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed up triage time and result in faster rewards. Please include specific details on where you identified the vulnerability, how you identified it, and what actions you were able to perform as a result. -Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC). \ No newline at end of file +Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC). diff --git a/submissions/description/insufficient_security_configurability/no_two_fa/recommendations.md b/submissions/description/insufficient_security_configurability/no_two_fa/recommendations.md index 91a24de7..1d320d28 100644 --- a/submissions/description/insufficient_security_configurability/no_two_fa/recommendations.md +++ b/submissions/description/insufficient_security_configurability/no_two_fa/recommendations.md @@ -1,3 +1,3 @@ **Recommendation(s)** -Implement a 2FA feature for all user accounts and ensure that privileged users are required to configure 2FA. \ No newline at end of file +Implement a 2FA feature for all user accounts and ensure that privileged users are required to configure 2FA. diff --git a/submissions/description/insufficient_security_configurability/no_two_fa/template.md b/submissions/description/insufficient_security_configurability/no_two_fa/template.md index 0f9d1a22..4aa83dc8 100644 --- a/submissions/description/insufficient_security_configurability/no_two_fa/template.md +++ b/submissions/description/insufficient_security_configurability/no_two_fa/template.md @@ -7,10 +7,12 @@ The application did not allow users to configure Two Factor Authentication (2FA) This vulnerability can lead to reputational damage and indirect financial loss to the company as customers may view the application as insecure. **Steps to Reproduce** - +1. Navigate to the following URL: {{URL}} +1. Identify the vulnerability by performing {{action}} +1. Observe the misconfiguration **Proof of Concept (PoC)** The following screenshot shows the account management options available to a user. As shown, the user is not provided with the option to configure 2FA: > ->{{screenshot}} \ No newline at end of file +> {{screenshot}}