The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

through to identify a perpetrator.

Example 6: Beating a Business Limit

The authors encountered this logic flaw in a web-based enterprise resource

planning application used within a manufacturing company. 

The Functionality

Finance personnel had the facility to perform funds transfers between various

bank accounts owned by the company and their key customers and suppliers.

As a precaution against fraud, the application prevented most users from pro-

cessing transfers with a value greater than $10,000. Any transfer larger than

this required a senior manager’s approval.

70779c11.qxd:WileyRed  9/14/07  3:14 PM  Page 360

---

The Assumption

The code responsible for implementing this check within the application was

extremely simple:

bool CAuthCheck::RequiresApproval(int amount)

{

if (amount <= m_apprThreshold)

return false;

else return true;

}

The developer assumed that this transparent check was bulletproof. No

transaction for greater than the configured threshold could ever escape the

requirement for secondary approval.

The Attack

The developer’s assumption was flawed because he had completely over-

looked the possibility that a user would attempt to process a transfer for a neg-

ative amount. Any negative number will clear the approval test, because it is

less than the threshold. However, the banking module of the application

accepted negative transfers and simply processed them as positive transfers in

the opposite direction. Hence, any user wishing to transfer $20,000 from

account A to account B could simply initiate a transfer of -$20,000 from account

B to account A, which had the same effect and required no approval. The anti-

fraud defenses built into the application could be trivially bypassed!