Client-Side Price Manipulation: Pay Whatever You Want at Checkout

Exploiting a server-side validation failure in 's checkout sends the order total straight from the browser. The server saves whatever it receives without recalculating from actual product prices. Change it to a penny, the order goes through at a penny.

Table of contents

Lab setup

From an empty directory:

CODE Kopieren

npx create-oss-store oss-store

cd oss-store

npm start

Or with Docker (no Node.js required):

CODE Kopieren

docker run -p 3000:3000 leogra/oss-oopssec-store

The app runs at http://localhost:3000.

Vulnerability overview

When you buy something on

Click "Complete Payment" and the browser fires off a POST with the order details, including the total the frontend calculated.

Exploitation

Configuring the proxy

Set up Burp Suite as an intercepting proxy (browser traffic through 127.0.0.1:8080). Leave interception off for now.

Preparing the order

Add products to your cart. Higher-priced items make the result more obvious. Go through checkout until you hit the payment page.

Looking at the request

The request body is JSON with the order details:

Completing the attack

Forward the modified request and turn off interception. The server processes the order at your price.

Capturing the flag

The order confirmation shows the purchase at the modified total. The server notices the mismatch and returns the flag:

CODE Kopieren

OSS{cl13nt_s1d3_pr1c3_m4n1pul4t10n}

/ ·
·