Unrestricted Access to Sensitive Business Flow - Shop - Coupon Claim

Vulnerability

[PASS] Unrestricted Access to Sensitive Business Flow - Shop - Coupon Claim

Description

Tested whether a sensitive business flow (claiming a coupon to top up the balance) can be abused by claiming the same coupon repeatedly (replay).

Impact

No impact: the server rejects a second claim of the same coupon (already claimed); the business flow is limited per user.

CWE

CWE-837: Improper Enforcement of a Single, Unique Action (tested, not vulnerable)

OWASP

API6:2023 - Unrestricted Access to Sensitive Business Flows (negative test)

Scenario

Normal: the first coupon claim succeeds (balance +75). Exploitation: replay the same coupon -> rejected (already claimed). PASS (control holds).

Endpoint

POST http://127.0.0.1:8888/workshop/api/shop/apply_coupon

Affected feature

Coupon Claim / Balance (crapi-workshop)

Remediation

Keep the per-user coupon claim restriction (the current state is correct).

Proof of concept

1. (Screenshot 1) NORMAL: apply_coupon TRAC075 for the first time -> succeeds, balance increases.
2. (Screenshot 2) EXPLOITATION: apply_coupon TRAC075 again -> rejected 'already claimed' (control holds).

The complete record

LAB All targets are lab systems. Nothing here is a client engagement. Evidence is shown as recorded; secrets are blacked out.

Normal: first coupon claim

Normal flow: the account's first claim of coupon TRAC075 succeeds and increases the balance.

HTTP request

POST /workshop/api/shop/apply_coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

{"coupon_code":"TRAC075","amount":75}

HTTP response

HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 57

{
  "credit": 175.0,
  "message": "Coupon successfully applied!"
}

Result: second coupon claim rejected (PASS)

Result (PASS): a second claim of the same coupon is rejected (already claimed). The per-user claim limit held in this test; no impact on confidentiality, integrity or availability was observed.

HTTP request

POST /workshop/api/shop/apply_coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]

{"coupon_code":"TRAC075","amount":75}

HTTP response

HTTP/1.1 400 Bad Request
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 97

{
  "message": "TRAC075 Coupon code is already claimed by you!! Please try with another coupon code"
}

← Previous case: Unauthenticated Order Access - Shop - Order Details Next case: Unrestricted Resource Consumption - Authentication - Login Rate Limiting →