SMS Verification Security#

SMS-based verification in lilishop contains two distinct security weaknesses in SmsUtilAliImplService, the sole implementation of the SmsUtil interface. Both weaknesses bypass the verification check entirely, rendering OTP protection ineffective for every SMS-gated flow.

Vulnerability 1: Universal Bypass Code "0"#

The verifyCode method accepts "0" as a valid code for any mobile number and any verification type:

if (code.equals(result) || "0".equals(code)) {

1

This means any unauthenticated caller who supplies code=0 will pass verification — no SMS ever needs to be sent or received.

Vulnerability 2: Predictable Test-Mode Code "111111"#

When SmsSetting.isTestModel is true 2, sendSmsCode sets the code to the hard-coded string "111111" instead of a randomly generated value, and skips sending an actual SMS:

if (smsSetting.getIsTestModel()) {
    code = "111111";
    log.info("测试模式 - 接收手机：{},验证码：{}", mobile, code);
}

3

If test mode is enabled in production (or left on after development), every SMS verification step becomes trivially bypassable with a fixed, publicly known code.

Affected Flows#

Both weaknesses are effective against every flow that calls smsUtil.verifyCode(...). The VerificationEnums enum enumerates the impacted scenarios:

UPDATE_PASSWORD and WALLET_PASSWORD are also defined in VerificationEnums 10 and route through the same verifyCode implementation.

Root Cause#

Both issues live entirely within SmsUtilAliImplService and have no corresponding feature flag or environment guard beyond the isTestModel setting. The "0" bypass is unconditional — it is active in every deployment, regardless of test-mode configuration.

Remediation Pointers#

• Remove the "0" bypass in verifyCode. There is no legitimate production use case for a universal master code.
• Gate isTestModel to non-production environments at the infrastructure level (e.g., environment variable check, Spring profile guard) so the SmsSetting flag 2 cannot be inadvertently enabled in production.
• Consider adding rate-limiting on SMS verification endpoints and expiring cached codes on repeated failed attempts to limit brute-force risk independently of these fixes.