Business Logic Vulnerabilities

• In this link we can understand what is meant by business logic vulnerabilities and its impact. This link here gives a more detailed and more example driven explanation of what is meant by business logic vulnerabilities.

Excessive trust in client-side controls

• This lab doesn't adequately validate user input. You can exploit a logic flaw in its purchasing workflow to buy items for an unintended price.
• To solve the lab, buy a "Lightweight l33t leather jacket". You can log in to your own account using the following credentials: wiener:peter

Enumeration

• We are given the webpage below, where it is an ecommerce shop, with a shopping cart.

• We can view products and even add to cart like below.

• There is user login

• When we login, we can see that there is a "Store Credit" as well as a user cart which is different from an anonymous cart.

• There is a /cart page where products that are added will show.

Vulnerability Assessment / Exploitation

• The vulnerable function in this case is the way where products are added to cart.
• As can be seen below, a product is added to cart and rather than fetching the price from the database, the product details are sent as a POST request.

• Therefore it seems like we can manipulate the price of the jacket simply by changing the price in the POST request like below.

• As can be seen below, the product is added to cart and we sucessfully checked out with a significantly low price for the product.

High-level logic vulnerability

• This lab doesn't adequately validate user input. You can exploit a logic flaw in its purchasing workflow to buy items for an unintended price. To solve the lab, buy a "Lightweight l33t leather jacket".

• You can log in to your own account using the following credentials: wiener:peter.

Enumeration

• We are given an ecommerce page that looks similar to the one above, with very similar functionalities with regards to the checkout and login.

• The difference in this web application is that the price is no longer sent in the POST request.
• As can seen above, the only variable that can be manipulated here is the quantity.

Vulnerability Assessment / Exploitation

• We then realised that quantity can actually be set to -1.

• We then intercepted the POST request and tested if the value can be set to more than -1.

• As can be seen below, the quantity is set to -3

• Additionally, we realised that "Add to cart" button is not the only button vulnerable to this. The "-", "+" and "remove" buttons are vulnerable to this too.

• It seems like there is a check for negative total value.
• We can get our item "Lightweight 'l33t' Leather Jacket" with a huge "discount" by setting other items to be a negative value and the leather jacket to a positive value.

Inconsistent security controls

• This lab's flawed logic allows arbitrary users to access administrative functionality that should only be available to company employees.
• To solve the lab, access the admin panel and delete Carlos.

Enumeration

• We do an initial directory enumeration and find that there is an /admin directory but it returns us a 401 Unauthorized error.

• Concurrently, we attached burp proxy and surfed the website normally trying all the functionalities

• It seems like there is no "Add to cart" function.

• There is a login page, but we are not given credentials. However, we also notice a register page.

• In this register page, it seems like anyone can register but we notice that for workers that work for DontWannaCry, their email domain is @dontwannacry.com. We are not given a donwannacry.com email but it might be useful later.

• Registering for a new user witht the email given to us.

• We go to the email given and followed the link to complete the registration.

• We are brought to the following page upon login, where the only function is to change our email address.

• It seems like the error message for /admin page is that we are not a DontWannaCry user.

Vulnerability Assessment / Exploitation

• Based on the information above, where DontWannaCry users have email address of @dontwannacry.com perhaps, we can bypass the authentication by simply having a dontwannacry email.

• We changed our email domain to dontwannacry.com and in the next picture, we can see that the admin panel appears.

- We proceed to the /admin page and delete the user carlos.

Flawed enforcement of business rules

• This lab has a logic flaw in its purchasing workflow. To solve the lab, exploit this flaw to buy a "Lightweight l33t leather jacket".
• You can log in to your own account using the following credentials: wiener:peter

Enumeration

• We visit the website and we get one like below, where they give out coupon and there is a cart, thus suggesting that the ecommerce function is working in this application.

- We scroll to the bottom of the page to see this "Sign up to our newsletter" function.

• Based on the client side source code, it seems like this sends a POST request with email account as a parameter to the /sign-up page.

• Upon sucessful sign up, the section changed into a javascript that prompts another discount code.

• There is indeed an add to cart function.

• There is also a login function and this time credentials are given and hence we will need to log in with the given credentials.

• So this is a view of the user /account page.

• Below is a picture of the user cart.

• When a coupon is applied it will be appended to a HTML table like below.

• There is checks to make sure the same coupon cannot be applied twice.

• There is also a check to make sure invalid coupon cannot be used.

• Below are the GET redirects when a coupon is applied sucessfully, or unsucessfully respectively.

Vulnerability Assessment / Exploitation

• Even though there are checks for the same coupon used consecutively, it seems like if a new coupon is added, we are able to stack the discount.

• And the best part is we can stack as many discounts as we want as long as they are not consecutive.

• Hence we stacked the coupon till the price of "Lightweight 'l33t' Leather Jacket" is zero before we make the purchase.