Promotion code can be used more than redemption limit.

Disclosed: 2023-02-13 22:04:14 By d_sharad To stripe
Low
Vulnerability Details
## Summary: While creating a promotion code a user can specify number of times that code can be redeemed.(i.e. Redemption limit) {F1962666} Codes aren't supposed to be redeemed more than the redemption limit. But there exists a race condition that allows use of promotion codes more than redemption limit. {F1962665} ## Steps To Reproduce: [In these steps i have used just a browser to show how easy this is to exploit and even a person with very limited knowledge on technology can exploit this. This can certainly be scaled using burp and other software .] 1. As a merchant create a promotion code with Redemption limit 1. {F1962664} 2. As a user, Visit any two payment links of same merchant with the coupon. 3. In both payment links, Fill the form and apply coupon but don't hit Pay/ Subscribe. 4.Hit both link's pay/subscribe button as fast as you can. 5. Both payment will be successful using one coupon two times. ## Supporting Material/References: I have added a video poc. In this poc, I have used a promotion code with redemption limit 2. I have also used laptops screentouch feature to click both link's pay/subscribe button as fast as I could. {F1962525} ## Impact Promotion code can be used more than redemption limit.
Actions
View on HackerOne
Report Stats
  • Report ID: 1717650
  • State: Closed
  • Substate: resolved
  • Upvotes: 47
Share this report