“Intigriti October CTF Writeup: Exploiting Flawed Business Logic for a 100% Discount”

Author: Md. Fahim Shakil Chowdhury Target: https://challenge-1026.challenges.intigriti.io Vulnerability Category: CWE-840 Business Logic Error / Flawed Enforcement of Business Rules Severity: Medium

The Intigriti October CTF presented participants with a beautifully themed e-commerce application called the "Halloween Store." The objective was to find a hidden flag by exploiting a vulnerability within the application's logic. Unlike challenges that rely on standard injection flaws (like SQLi or XSS), this application was a textbook example of how flawed enforcement of business rules can lead to critical financial exploits.

By analyzing the application's behavior and manipulating the shopping cart's promotional code feature, I was able to bypass the pricing model entirely, reduce a €666.00 order to €0.00 and capture the flag.

Reconnaissance and Information Gathering:

The first phase of the challenge involved mapping the application's features and identifying intended user interactions. The "Halloween Store" offered various seasonal sweets and a shopping cart system. While interacting with the site, two distinct promotional codes were discovered:

1. The Newsletter Promotion: At the bottom of the homepage, there is an "OCTOBER NEWSLETTER" subscription box. By entering an email address (e.g., test@gmail.com), the application triggers a backend request. Intercepting this traffic reveals that the server responds with a JSON payload containing a 30% discount code: NEWS30.

2. The High-Value Item Promotion: Browsing the products, adding the most expensive item to the bag, "The Midnight Collection" priced at €666.00 triggers a secondary business rule. The UI displays a notification revealing another promotional code for 20% off: NIGHT20.

With two valid promotional codes in hand, the next step was to test how the application's cart validation logic handled discounts.

Analyzing the Business Logic Flaw:

Standard e-commerce business rules typically dictate that a single promotional code can only be applied once per transaction. To test the application's enforcement of these rules, the following steps were taken in the cart's Order Summary:

1. Applying the first code NEWS30 successfully reduced the total price.
2. Attempting to apply NEWS30 a second time consecutively resulted in an expected error; the application recognized that the coupon was already applied.
3. However, applying the second code NIGHT20 was accepted by the application, stacking the 20% discount on top of the existing 30% discount.

This behavior revealed a critical flaw in the backend validation. The system was not verifying the newly submitted coupon against a complete array of all previously applied coupons for that session. Instead, it appeared to be performing a simple consecutive check (e.g., if current_coupon == last_applied_coupon, reject).

Because NEWS30 did not match the last applied coupon (NIGHT20), the system's rudimentary check was successfully bypassed when attempting to reapply the first code.

Exploitation: Chaining Discounts to Zero

Understanding this logic flaw, the exploitation path was straightforward: alternate the application of the two coupons to infinitely stack the discounts until the cart total was completely depleted.

The codes were applied in an alternating sequence:

1. Apply NEWS30 (total decreases to €466.20).

2. Apply NIGHT20 (total decreases further to €372.96).

3. Apply NEWS30 (accepted again, bypassing the single-use rule, total decreases to €261.07).

4. Apply NIGHT20 (accepted again).

By repeating the sequence NEWS30 -> NIGHT20 -> NEWS30 -> NIGHT20, the discounts continuously compounded. The initial cart total of €666.00 was systematically reduced to €399.60, then €266.40, then €133.20 and finally down to exactly €0.00.

Once the total hit €0.00, the "Complete order" button was clicked. Because the transaction total was zero, the application bypassed the standard payment gateway validation that would normally halt an unfunded transaction. The server processed the free order and returned a successful 200 OK HTTP response.

Capturing the Flag:

The successful exploitation rendered an "ORDER CONFIRMED" modal on the frontend UI, showing that order number BLE-D39330DD32 was paid with €0.00 in store credit.

The hidden flag was revealed in two places:

Frontend UI: Printed directly within the "INSIDE THE ARCHIVE" box on the confirmation modal.

Backend Response: Returned seamlessly within the JSON confirmation message in the raw HTTP response:

{ "receipt": "…", "message": "Your order is confirmed and here is your flag", "flag": "INTIGRITI{094638e6-xxxx-xxxx–xxxx–41ced0d5debd}" }

Capturing this flag triggered the "Congratulations! CTF Solved!" success screen, validating the completion of the challenge.

Remediation and Secure Design

This vulnerability highlights the dangers of relying on superficial state checks for critical financial logic. To secure this implementation, developers must transition from a "last-applied" validation model to a robust session-state model:

1. Comprehensive State Tracking: The server's cart session object must maintain a persistent array (or set) of all applied_promotions.
2. Strict Validation Iteration: When a new promotional code is requested, the backend must iterate through the entire applied_promotions array. If the code exists anywhere in the history of that order, it must be rejected.
3. Hard Stacking Limits: Implement global business rules at the final price calculation stage that cap maximum discount percentages (e.g., never exceeding 50% off) or restrict the total number of applied codes to a hard limit of one per transaction.