Does Intercepting and manipulating the Google reCaptcha response on client side, can provide a false sense of security?

Question

I have integrated Google Recaptcha in Sitecore form (10.2 ). While doing a security audit, it was found that while submitting the form data, post request can be intercepted (via tools like Burp Suite), and the response value ( mentioned here) can be deleted from the request body and forwarded without any error, which gives the impression of false security.

Thus while debugging the response results from a custom validation class, and from the submit button script on the client side, the Google captcha response was available even after deleting it from the request body using the tool.

So, I want to understand, does the Interception of Google Recaptcha using tools like Burp Suite, actually affect the captcha response, if yes, what could be the possible ways to stop such vulnerability?

Thanks in advance.

Answer 1

The main function of CAPTCHA is to make sure no robot can submit the form with CAPTCHA code. Meanwhile in your case it was human that fill the CAPTCHA and submit the form, but the process intercepted by Burp Suite which IMO is already outside of CAPTCHA scope. The task of preventing a robot submitting the form is achieved.

In terms of security, what you need to do is a secure validation on your back end side. I'm sure out-of-the-box Sitecore form elements have a high standard secure validation for it.

Answer 2

The issue was resolved by creating a validation class inheriting Sitecore.ExperienceForms.Mvc.Models.Validation.ValidationElement, where the re-captcha response from the client fetched using HttpContext.Current?.Request?.Form["g-recaptcha-response"] is matched using google API mentioned here