Exploiting a server-side validation failure in OopsSec Store 's checkout process to purchase products at arbitrary prices.

OopsSec Store 's checkout sends the order total straight from the browser. The server saves whatever it receives without recalculating from actual product prices. Change it to a penny, the order goes through at a penny.

Table of contents

Lab setup

From an empty directory:

npx create-oss-store oss-store cd oss-store npm start

Enter fullscreen mode

Exit fullscreen mode

Or with Docker (no Node.js required):

docker run -p 3000:3000 leogra/oss-oopssec-store

Enter fullscreen mode

Exit fullscreen mode

The app runs at http://localhost:3000 .

Vulnerability overview

When you buy something on OopsSec Store , the browser sends a POST to /api/orders with the cart items and a total field. That total is calculated by frontend JavaScript. The server takes it at face value and creates the order.

The product prices are in the database. The server could look them up and do the math itself.…