UIDAI Aadhaar CAPTCHA Bypass Vulnerability

Key Takeaways & TL;DR

UIDAI's Aadhaar verification API accepted a client-controlled captchaLength parameter in the JSON payload. Tampering this value from 6 to 1 reduced the generated CAPTCHA to a single character, enabling trivial automated OCR solving.

A CAPTCHA test is commonly used online to verify if a user is human or a bot. Usually, these tests involve typing in a series of letters, often six, generated by the server.

myAadhaar portal showing standard CAPTCHA verification — The myAadhaar portal verification form with CAPTCHA

However, on the UIDAI website, which verifies Aadhaar Numbers and provides user demographic data, the CAPTCHA is generated by the server but relies on client-side input for customization. This is an unusual and insecure approach.

Network request payload with captchaLength parameter — Inspecting the request payload: captchaLength is specified by the client

The website's API allows users to adjust the length of the CAPTCHA. Typically set to 6 letters, it can be reduced to just 1. This greatly simplifies the CAPTCHA solving process. Moreover, if the API is heavily used, setting the CAPTCHA length to 1 makes it trivial for automated systems to solve it using simple image recognition or OCR tools.

Original curl request with captchaLength 6 — Initial curl request with default captchaLength of 6

Modifying curl request payload with captchaLength 1 — Tampering the request payload to request a captchaLength of 1

Server response containing base64 image data for 1-char captcha — Server accepts parameter and returns base64 image data

Decoded base64 single character CAPTCHA — Decoded image showing a single-character CAPTCHA ("3")

This unconventional setup by UIDAI raises concerns about the security of their system, especially considering the sensitive nature of the Aadhaar demographic data they handle.

UIDAI Aadhaar CAPTCHA Bypass

Other Posts