59

So, some time ago, I was working for a complete puckered anus of a cosmetics company on their ecommerce product. Won't name names, but they're shitty and known for MLM. If you're clever, go you ;)

Anyways, over the course of years they brought in a competent firm to implement their service layer. I'd even worked with them in the past and it was designed to handle a frankly ridiculous-scale load. After they got the 1.0 released, the manager was replaced with some absolutely talentless, chauvinist cuntrag from a phone company that is well known for having 99% indian devs and not being able to heard now. He of course brought in his number two, worked on making life miserable and running everyone on the team off; inside of a year the entire team was ex-said-phone-company.

Watching the decay of this product was a sheer joy. They cratered the database numerous times during peak-load periods, caused $20M in redis-cluster cost overrun, ended up submitting hundreds of erroneous and duplicate orders, and mailed almost $40K worth of product to a random guy in outer mongolia who is , we can only hope, now enjoying his new life as an instagram influencer. They even terminally broke the automatic metadata, and hired THIRTY PEOPLE to sit there and do nothing but edit swagger. And it was still both wrong and unusable.

Over the course of two years, I ended up rewriting large portions of their infra surrounding the centralized service cancer to do things like, "implement security," as well as cut memory usage and runtimes down by quite literally 100x in the worst cases.

It was during this time I discovered a rather critical flaw. This is the story of what, how and how can you fucking even be that stupid. The issue relates to users and their reports and their ability to order.

I first found this issue looking at some erroneous data for a low value order and went, "There's no fucking way, they're fucking stupid, but this is borderline criminal." It was easy to miss, but someone in a top down reporting chain had submitted an order for someone else in a different org. Shouldn't be possible, but here was that order staring me in the face.

So I set to work seeing if we'd pwned ourselves as an org. I spend a few hours poring over logs from the log service and dynatrace trying to recreate what happened. I first tested to see if I could get a user, not something that was usually done because auth identity was pervasive. I discover the users are INCREMENTAL int values they used for ids in the database when requesting from the API, so naturally I have a full list of users and their title and relative position, as well as reports and descendants in about 10 minutes.

I try the happy path of setting values for random, known payment methods and org structures similar to the impossible order, and submitting as a normal user, no dice. Several more tries and I'm confident this isn't the vector.

Exhausting that option, I look at the protocol for a type of order in the system that allowed higher level people to impersonate people below them and use their own payment info for descendant report orders. I see that all of the data for this transaction is stored in a cookie. Few tests later, I discover the UI has no forgery checks, hashing, etc, and just fucking trusts whatever is present in that cookie.

An hour of tweaking later, I'm impersonating a director as a bottom rung employee. Score. So I fill a cart with a bunch of test items and proceed to checkout. There, in all its glory are the director's payment options. I select one and am presented with:

"please reenter card number to validate."

Bupkiss. Dead end.

OR SO YOU WOULD THINK.

One unimportant detail I noticed during my log investigations that the shit slinging GUI monkeys who butchered the system didn't was, on a failed attempt to submit payment in the DB, the logs were filled with messages like:

"Failed to submit order for [userid] with credit card id [id], number [FULL CREDIT CARD NUMBER]"

One submit click later and the user's credit card number drops into lnav like a gatcha prize. I dutifully rerun the checkout and got an email send notification in the logs for successful transfer to fulfillment. Order placed. Some continued experimentation later and the truth is evident:

With an authenticated user or any privilege, you could place any order, as anyone, using anyon's payment methods and have it sent anywhere.

So naturally, I pack the crucifixion-worthy body of evidence up and walk it into the IT director's office. I show him the defect, and he turns sheet fucking white. He knows there's no recovering from it, and there's no way his shitstick service team can handle fixing it. Somewhere in his tiny little grinchly manager's heart he knew they'd caused it, and he was to blame for being a shit captain to the SS Failboat. He replies quietly, "You will never speak of this to anyone, fix this discretely." Straight up hitler's bunker meme rage.

Comments
  • 21
    Cont.:

    20 minutes later, I push a patch to the ingress proxy that ensures that the user who is tokened is the user whom the impersonation system is allowed for and their rank and reporting structures are enforced.

    Did it stay fixed? Who knows, I was conveniently let go a few months later. I definitely know it's still there in the service layer. The moral of the story is fuck people, because they fucking deserve it.
  • 3
    Did they just.... put "everything" in redis as a performance solution or something?
  • 5
    @N00bPancakes
    Mostly "carts," sometimes upwards of 700M carts.
  • 9
    That’s one beautiful Mongolian man. 😂
  • 3
    But holy shit at that fuckup.
  • 3
    @Root
    Maybe he's born with it 😋

    But yeah. I mean, you could also just copy a token cooked and you were auth'd. Typical windows shitshow
  • 12
    After 'You will never speak of this to anyone,' your first question should have been along the lines of, 'how much of a raise and/or bonus am I getting?'
  • 1
    @SomeNone
    Nah, situation like this, thats just begging to hold the bag for the cover-up.
  • 3
    @SortOfTested what you should have actually done is compiled all the evidence into an engaging and amusing powerpoint presentation, send one more order (at about the price of half a million or so), as the ceo of the company (or whoever non-it, above-it, highest manager you could get hold of), put something into order note (if the system has anything like that), THEN apply the fix, then immediately call that high-up and be like "as you might have noticed, you have ordered something that you haven't ordered. i need to talk about this with you (and rest of upper management) personally asap.

    then go there, do the presentation, make it clear that head of it wanted you to stay silent because he knows it's their fault, let them panic for a minute, and then add "btw i fixed it right before i called you, mr. ceo".
  • 2
    the gatcha comment took this from gold to diamond.

    absolutely fantastic post.
  • 0
    @Midnight-shcode
    That would work, if the CEO was part of the sales org. Sadly, he was not.
  • 1
    But how would you issue a patch. Wouldn't the patch be seen by anyone on github or gitlab or bitbucket or whichever git repository hosting platform the company uses unless they dont use a git repo or any version control. The patch needs to approved first then then you would deploy the solution. And you were not supposed to share it with anyone. How would you do that if any person on the organization with access to the repo can see the difference
  • 1
    @AkshayTolwani
    He was employing a rhetorical device known as "euphemism." The equivalent for you would be "fix this quietly, do the needful."
  • 0
  • 0
    It’s incredible how companies are unaware of how fragile their systems are some times.
Add Comment