Summary
The race condition allows the user to bypass the limit on the number of promotion codes and use the discount coupon multiple times.
Details
In "alf.io", admin can apply price discounts by using promo codes to their events.
And admin can limit the number of promo codes that will be used for events, but the time-gap between checking the number of codes and restricting the use of the codes allows attackers to bypass the promo code limit.
PoC
- The validity of the promo code is checked twice during the entire reservation process, so there are two race conditions are needed.
-
Create an event.
-
Create a promo code. (note that the maximum number is one)
-
Try reservations in different sessions.
-
The first race condition is used here. There are several methods to perform a race condition in this case, but here I used "Last-byte synchronization" to ensure a stable race condition. (reproducible via burpsuite's Group send feature)
-
Check that the step has progressed, with the first validation bypassed.
-
Prepare the race condition again for the second verification.
-
Check that the two discounted registrations were successful, bypassing the promo code restrictions as expected.
-
This can be clearly seen on the admin page.
Impact
It can be disruptive and financially damaging.
Summary
The race condition allows the user to bypass the limit on the number of promotion codes and use the discount coupon multiple times.
Details
In "alf.io", admin can apply price discounts by using promo codes to their events.
And admin can limit the number of promo codes that will be used for events, but the time-gap between checking the number of codes and restricting the use of the codes allows attackers to bypass the promo code limit.
PoC
Create an event.
Create a promo code. (note that the maximum number is one)
Try reservations in different sessions.
The first race condition is used here. There are several methods to perform a race condition in this case, but here I used "Last-byte synchronization" to ensure a stable race condition. (reproducible via burpsuite's Group send feature)
Check that the step has progressed, with the first validation bypassed.
Prepare the race condition again for the second verification.
Check that the two discounted registrations were successful, bypassing the promo code restrictions as expected.
This can be clearly seen on the admin page.
Impact
It can be disruptive and financially damaging.