Chess.com Business Logic Bypass Vuln!

One day I was playing chess while having some coffee, but after a nasty lose streak and getting absolutely zero freelance jobs, I eventually decided to connect Burp Suite to chess.com 💀

The first thing I noticed was that chess.com has a game analysis feature after you finish a game. This is one of the features heavily marketed to premium users.

The bug itself turned out to be a duplicate, but honestly, I'm still proud that I managed to find a bug in a pretty big company :v

Here's how I found it:

1. Logged into my chess.com account.
2. Made sure I could capture the WebSocket request from the game analysis endpoint and had already hit the analysis limit for my current session.

Step to exploit

1. Replaced the game.pgn field with any valid PGN — I used the Opera Game by Paul Morphy as an example.
2. I had to mess around with a few payloads to match the request body expected by chess.com because, ngl, I was kinda confused at first 💀
3. Sent the modified request.
4. Checked the WebSocket response… and apparently, there was no proper server-side validation for the current session.

And yeah… somehow the request still went through.

Even crazier, I could change the analysis engine to Deep Scan, basically a much deeper chess engine analysis similar to Stockfish, which is normally only available as a premium feature.

The bug was eventually marked as a duplicate, but still, finding something like this on a major platform was pretty damn satisfying.

There's still a lot to learn, but honestly, every duplicate, rejection, accepted report, and random late-night Burp session is part of the journey.

One bug at a time. 🫡

#Cybersecurity #BugBounty #WebSecurity #HackerOne #BurpSuite #EthicalHacking