Getting unlimited money by abusing the 'Send Money' feature

 

 

 

It has been a while since I published a post. So, I am writing this one to share one of my interesting finding while testing an e-wallet application.

 

 

I glanced at my Total Balance and I was wondering if there was a way for me to increase it arbitrarily. So, I thought Race Condition would help me here. 

What is a Race Condition vulnerability?

"A race condition vulnerability typically occurs when your application has access to the same shared data and attempts to change variables within it simultaneously." - automox.com

So, I loaded up Turbo Intruder in Burp Suite and attempted testing it.

I failed. I couldn't exploit it.  I didn't want to give up this soon.

I kept that fire bottled up and changed my approach. I realized that the 'Send Money' feature uses basic maths to reduce balance from the sender's account and add it to the receiver's account. So, the feature did the following operations:

 

function sendMoney(sender, receiver, amount) {

        sender.balance -= amount;

         receiver.balance += amount;

}

Now, I asked myself, would it be possible to send a negative balance? If it would be, then I could add the balance to my account and reduce it from the receiver's account. So, I sent -1000 to the receiver. Surprisingly, it worked and increased my balance from 100 to 1100.