Promotion code can be used more than redemption limit.
Low
S
Stripe
Submitted None
Actions:
Reported by
d_sharad
Vulnerability Details
Technical details and impact analysis
## Summary:
While creating a promotion code a user can specify number of times that code can be redeemed.(i.e. Redemption limit)
{F1962666}
Codes aren't supposed to be redeemed more than the redemption limit.
But there exists a race condition that allows use of promotion codes more than redemption limit.
{F1962665}
## Steps To Reproduce:
[In these steps i have used just a browser to show how easy this is to exploit and even a person with very limited knowledge on technology can exploit this. This can certainly be scaled using burp and other software .]
1. As a merchant create a promotion code with Redemption limit 1.
{F1962664}
2. As a user, Visit any two payment links of same merchant with the coupon.
3. In both payment links, Fill the form and apply coupon but don't hit Pay/ Subscribe.
4.Hit both link's pay/subscribe button as fast as you can.
5. Both payment will be successful using one coupon two times.
## Supporting Material/References:
I have added a video poc.
In this poc, I have used a promotion code with redemption limit 2.
I have also used laptops screentouch feature to click both link's pay/subscribe button as fast as I could.
{F1962525}
## Impact
Promotion code can be used more than redemption limit.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Time-of-check Time-of-use (TOCTOU) Race Condition