Race Condition in FOSSBilling Promo Code Validation

Impact Analysis

This vulnerability can lead to financial loss because an attacker or malicious client can exploit the race condition to use promo codes more times than allowed, potentially obtaining unlimited discounted or free products or services.

It undermines the intended business logic and promotional controls, allowing abuse of limited-use promo codes which can affect revenue and trust in the billing system.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in FOSSBilling, an open-source billing and client management system, prior to version 0.8.0. It is caused by a race condition in the cart checkout flow that allows an authenticated client to apply a promo code more times than its configured maximum usage limit.

By sending multiple concurrent checkout requests before any single request completes updating the promo code usage count, a client can bypass the usage limit and obtain unlimited discounted or free orders from a promo code that is intended for single or limited use.

Version 0.8.0 of FOSSBilling patches this issue. Workarounds include disabling promo codes until the patch is applied or monitoring the promo code usage in the database to detect and manually review any promo codes used beyond their allowed limits.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the promo code usage in the system. Specifically, you should monitor the `promo` table for `used` values that exceed the configured `maxuses` value.

Since the issue involves concurrent checkout requests, you can also look for multiple simultaneous checkout requests applying the same promo code before the usage count increments.

A suggested approach is to query the database to find promo codes where the number of times used exceeds the maximum allowed uses.

• Example SQL command to detect overused promo codes: SELECT promo_code, used, maxuses FROM promo WHERE used > maxuses;
• Monitor web server logs or application logs for concurrent checkout requests using the same promo code.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to disable promo codes entirely until the system is patched to version 0.8.0 or later.

Alternatively, you can monitor the `promo` table for any promo codes where the `used` count exceeds the `maxuses` and manually review and address affected orders.

Useful 0 Not Useful 0