[⭐] Free deluxe membership (already existing vulnerability in juice-shop)

⭐ Challenge idea

Description

The rest/deluxe-membership route is vulnerable. Users can upgrade themselves to deluxe members by simply making a POST request to this path with the following parameters

• UserId: your uid(which you can get by decoding your jwt)
• payUsingWallet: false

Though this can be easily fixed with minor refactoring, I propose that we make this into a challenge instead

Underlying vulnerability/ies

I guess this would fall under Security Misconfiguration or Miscellaneous

Expected difficulty

✔️ / ❌	Difficulty
✔️	⭐⭐

Possible attack flow

You can replicate the attack right now by making a POST request to localhost:3000/rest/deluxe-membership with the following params

• UserId: your uid(which you can get by decoding your jwt)
• payUsingWallet: false
• After that, logout and login again to refresh your JWT. You are now a deluxe-member and no amount has been deducted from your wallet

This vulnerability can be discovered by examining the requests made when one tries to pay for deluxe membership and then fu

[bkimminich]

Yeah well, it unfortunately doesn’t work as simple as currently implemented. Just try this:

1. Log in with credentials demo / demo
2. Go to Deluxe Membership page and click the button to become a member
3. Choose the pre-existing credit card for payment and click Continue
4. The challenge is triggered as solved. Although you “paid” for it.

Simple “fix” would be giving the payUsingWallet=true|false needs an “upgrade” into something like payment=wallet|card and when that parameter is empty you’d still get your membership. Then it’d be believable business logic flaw and sufficiently different from the password change challenge where the old-password parameter is supposed to be missing entirely to change anyones password.

[github-actions[bot]]

This thread has been automatically locked because it has not had recent activity after it was closed. 🔒 Please open a new issue for regressions or related bugs.