You mean like how Authy specialised in two-factor authentication, but still managed to have basic string concatenation bugs that rendered their entire 2FA system bypassable?
But if you just want the money shot: http://sakurity.com/img/smsauthy.png
Yes. Typing '../sms' in the field bypassed the 2nd factor. Just, wow.
Amazing what you can do with improperly-implemented input sanitation :)
This probably could've been prevented by disallowing non-number inputs, no?
They were doing the input sanitation, but it wasn't the very first thing in the processing pipeline, since "best practice" was to pipe everything through 'rack-protection' first.
Homokov was first to state, this was really a black-swan type bug which 99.9% of the time makes it into production. Apparently, they were doing the "right thing" and still got burned.
*HomAkov
Basically, the form itself could have (and maybe even should have) required numeric-only values, seeing as Authy's codes are either 6 or 7 digits long and contain no alphabetical or special characters.