How I Discovered a Critical Unauthorized Balance Top-Up Vulnerability Worth $3,000

How I Discovered a Critical Unauthorized Balance Top-Up Vulnerability Worth $3,000

Hello Everyone,

I hope you all are okay by the Blessings of Almighty Allah and Also Take my salam. I started Bug Bounty in December 2022. Many People had helped me to grow in this field. I want to mention Md. Asif Hossain & Imran Huda Vai. They taught me the tips and tricks of bug bounty hunting and played a significant role in helping me grow from a beginner into a professional security researcher.

on October 18, 2024, I was trying to find the vulnerability and working around 9 hours But I didn't get anything. Then I decided to go to bed at 2:30 AM. I have a habit of checking my email before going to sleep and immediately after waking up. That night, while lying in bed, I noticed an email announcing a newly added asset in a private bug bounty program. Without thinking twice, I decided to start hunting on it.

While reviewing the application, Although I had already found three CSRF vulnerabilities, I wanted to keep digging in search of something more impactful. When I navigated to the Billing section, I noticed that after adding my credit card, I could use the API service.

I reviewed my Burp Suite history and noticed an interesting request to /api/credits.

{"amount":0,"pending":0}

{"amount":0,"pending":0}

Now suddenly, my mind can try the response manipulation and increase the amount "amount":0 to "amount":100 then what will happen?

Then I captured the request in BurpSuite and manipulated the response. I saw that The modified response changed the UI, which made me think there might be an underlying server-side issue. When I reloaded the browser I saw that time I was not getting that functionality. Now I think here I can try something. And something I was done. At that point, I knew that simply changing the response in Burp Suite would never affect the actual account balance because it was only modifying data locally in my browser. If there was a real vulnerability, it had to exist on the server side.

So I started looking through every request related to the billing feature. After spending some time analyzing the traffic, I found an interesting API endpoint:

POST /api/credits/top-up

POST /api/credits/top-up

The request body looked like this:

{
  "amount": 40000,
  "threshold": "50000"
}

{
  "amount": 40000,
  "threshold": "50000"
}

The amount and threshold values immediately caught my attention. Normally, adding credits should require a successful payment through the payment gateway before the backend updates the account balance. Seeing these values directly sent by the client made me wonder whether the server was actually validating them.

I intercepted the request with Burp Suite and started modifying the parameters. First, I increased the amount to a much larger value. I also changed the threshold parameter and forwarded the request without completing any payment.

A few seconds later, I refreshed the Billing page.

To my surprise, my account balance had increased immediately.

I repeated the test multiple times with different values to make sure it wasn't a caching issue or a client-side display bug. Every time, the backend accepted my modified request and updated my account credits without requiring any successful payment transaction.

At that moment, I realized I had discovered a critical business logic vulnerability. Any authenticated user could arbitrarily increase their account balance and consume paid API services without paying, potentially causing significant financial loss to the company.

I immediately recorded a proof-of-concept video, documented every reproduction step, and submitted the report through HackerOne with all the necessary evidence. Fortunately, the security team quickly reproduced the issue, acknowledged the vulnerability, and validated the report.

Timeframe

• October 18, 2024 (10:06 PM UTC): I discovered the vulnerability, completed my testing, and submitted the report.
• Following triage: The security team successfully reproduced the issue and validated it as a Critical severity vulnerability (CVSS 9.8).
• November 2, 2024 (12:26 AM UTC): The vulnerability was resolved, and I received a $3,000 bounty for the report.

This was one of my favorite findings because it reminded me that sometimes the biggest vulnerabilities are hidden behind simple requests. What started as a failed response-manipulation experiment eventually led to discovering a critical business logic flaw that could have caused significant financial impact.

I hope you enjoyed reading this write-up. If you have any questions or suggestions, feel free to reach out. Happy hacking!