Race Condition in Redeeming Coupons

Disclosed: 2016-09-12 08:40:37 By cablej To instacart
Unknown
Vulnerability Details
Hello, There exists a race condition in redeeming coupons, allowing a user to redeem the same coupon multiple times, and stacking savings added. This allows for a user to get virtually any discount. POC: 1. Visit your account and select 'Promo Codes'. 2. Select redeem promo code, and add any promo code. For example, I found the code 'dallas20'. 3. Intercept the request using a proxy, and make the request multiple times, asynchronously. 4. The code will be redeemed multiple times. For an example, see the screenshot attached.
Actions
View on HackerOne
Report Stats
  • Report ID: 157996
  • State: Closed
  • Substate: resolved
  • Upvotes: 36
Share this report