[⭐] Infinite free wallet funds (already existing vulnerability in juice-shop)

⭐ Challenge idea

Description

The route rest/wallet/balance with the HTTP method PUT is used to add new funds to the digital wallet. If done through the GUI, the user needs to have a saved credit card and, also, the amount of money added into the wallet is restricted between 10 and 1000.

If you send the PUT request with the header Authorization and the body {"balance": 2000000} you can add funds to the wallet without a credit card saved and bypassing the limit.

I have checked that then you can buy products in the shop using the wallet, and it is possible.

I guess in real life this bug would not be possible, as the transaction from a real bank account and the digital wallet needs to be performed to get the money. However, it is strange to be able to do this in the Juice Shop without it being a challenge. Plus, for beginners (like me) it is quite an accessible and interesting challenge.

Underlying vulnerability/ies

The vulnerability would be both Improper Input Validation and something else (regarding the free funds) but I do not know how to name it.

Expected difficulty

✔️ / ❌	Difficulty
✔️	⭐
✔️	⭐⭐
❌	⭐⭐⭐
❌	⭐⭐⭐⭐
❌	⭐⭐⭐⭐⭐
❌	⭐⭐⭐⭐⭐⭐

Possible attack flow

1. Log in as a user.

2. Add either less than 10 dollars (not allowed by the GUI) or add money from no apparent credit card origin.

3. Spend this money on Juices. 😃

[bkimminich]

Closed as this will rather be “fixed” than converted into a challenges to avoid duplications.

[bkimminich]

Hm, personally I’d rather see the wallet funds increase flow to be actually secured in some way. Can be broken still, but it shouldn’t be this trivial to get unlimited 💰 in the wallet. We kind of have a similar challenge with the negative quantities being put in the shopping basket anyway.

So the challenge idea is great, it just should be made more difficult imo.