Insufficient workflow validation | Dec 20, 2022

Introduction

Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: Insufficient workflow validation! Without further ado, let’s dive in.

Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆

Background

This lab makes flawed assumptions about the sequence of events in the purchasing workflow. To solve the lab, exploit this flaw to buy a “Lightweight l33t leather jacket”.

You can log in to your own account using the following credentials: wiener:peter

Exploitation

Home page:

Login as user wiener:

Now, we can try to buy the Lightweight l33t leather jacket:

When we clicked the Add to cart button, it’ll send a POST request to /cart, with parameter productId=1, redir=PRODUCT and quantity.

Then, we can go to /cart page:

As you can see, we have added that product to our cart.

Let’s try to click the Place order button:

When we clicked that button, it’ll send a POST request to /cart/checkout, with parameter csrf.

Let’s forward that request:

When we don’t have enough store credits, it’ll send a GET request to /cart, with parameter err=INSUFFICIENT_FUNDS.

Let’s remove that product from our cart:

When we clicked the Remove button, it’ll send a POST request to /cart, with parameter productId, quantity and redir=CART.

Armed with above information, what if we successfully bought a product?

Let’s say product Eggtastic, Fun, Food Eggcessories

When we have enough store credits, it’ll send a GET request to /cart/order-confirmation, with parameter order-confirmed=true.

Hmm… What if we add the leather jacket to cart, and then send a GET request to /cart/order-confirmation with parameter order-confirmed=true?

Let’s do that:

We did it!

What we’ve learned:

Insufficient workflow validation