Race Condition Vulnerability in CreateOrder Method (CVE-2024-53476)

[AbdullahAlmutawa]

Description

The CreateOrder Method in the OrderService.cs is vulnerable to a race condition that allows multiple simultaneous requests to oversell products. This issue enables attackers to purchase more items than are available in stock by exploiting the timing window between stock checks and stock updates, leading to negative stock quantities and unauthorized purchases.

Steps to Reproduce (PoC)

An attacker can exploit this vulnerability by attempting to purchase a product at almost the same time with limited stock (stock = 1) using two accounts. If both accounts successfully purchase the product, it confirms the presence of a race condition. This can be done using custom scripts or Burp Suite turbo intruder to send concurrent checkout requests.
To further demonstrate the vulnerability, please refer to the following YouTube video:POC

Suggested Fix

Vulnerable code from OrderService.cs:

To mitigate this vulnerability, implement atomic operations or utilize database transactions with appropriate locking mechanisms to ensure that stock checks and updates occur as a single, indivisible operation.

Useful Links

https://cwe.mitre.org/data/definitions/362.html
https://github.com/AbdullahAlmutawa/CVE-2024-53476

[hishamco]

Thanks for reporting this @AbdullahAlmutawa, do you plan to create a PR or should I do it so quick