This is a vulnerability I found in a Bug Bounty program on HackerOne. The report has already been resolved but has not been made public yet, so I will replicate the vulnerability in this post so you can keep it in mind when doing Bug Bounty or even during your day-to-day work.
After spending several days trying to find a vulnerability in that program without success, I was about to give up, but I decided to check the referral codes section, since it is a quite forgotten feature inside the user profile.
Searching online I found two codes and, testing with different accounts, both worked. At that moment I thought: what if I try to apply both codes at the same time?
So I registered a new user in the application, sent the request to apply the code twice to Burp Suite’s Repeater, and in each request I used a different code. It is also very important to group both requests and send them as a parallel group: Send group (parallel).
In the first image you can see how the code SRPTEDPHA is added from the URL and the backend returns an identifier for the code number 2000195. Also note the date: it was added at 19:04:21.925.
In the second image you can see how the backend also accepts the second code SRPS4TAPV. The identifier increased by one, up to 2000196, and the creation date is practically the same: if you look closely, it was added at 19:04:21.926, just one millisecond apart or even less.
The attack worked thanks to the simultaneity of both requests. The backend did not have time to process and register the first code before receiving the second one, so when checking whether a code had already been applied, the check returned false in both cases and both passed the validation.
The final impact of this vulnerability is that a user could add multiple referral codes when the application limited it to a maximum of one. This affects the integrity of the application, and especially the financial side, since each code was worth around $20 in rewards.
Unfortunately, I was not able to test it fully because it was a foreign application where you had to deposit $3,000 in order to receive the $20 per code. Even so, the vulnerability was accepted without any problems, apart from being asked for more information, something common in most Bug Bounty programs.
This vulnerability has already been resolved, but the report has not been published yet. When it is made public, I will add the link in this same article.