The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

each condition using one or both users, and determine whether the other

user is affected in each case.

Example 11: Racing against the Login

This logic flaw has affected several major applications in the recent past.

The Functionality

The application implemented a robust, multistage login process in which

users were required to supply several different credentials to gain access.

The Assumption

The authentication mechanism had been subject to numerous design reviews

and penetration tests. The owners were confident that no feasible means

existed of attacking the mechanism to gain unauthorized access.

The Attack

In fact, the authentication mechanism contained a subtle flaw. Very occasion-

ally, when a customer logged in, he gained access to the account of a com-

pletely different user, enabling him to view all of that user’s financial details,

and even make payments from the other user’s account. The application’s

behavior appeared initially to be completely random: the user had not per-

formed any unusual action in order to gain unauthorized access, and the

anomaly did not recur on subsequent logins.

After some investigation, the bank discovered that the error was occurring

when two different users logged in to the application at precisely the same

moment. It did not occur on every such occasion — only on a subset of them.