The Bug That Kept On Giving :: PaymentBypass :: Response Manipulation

How we got there

A story of the third bug i found after the one for QR CODE And the Next Exposed Return URL

It was the same program xboy (why). xboy had a website offering an option to buy e-giftcards. https://xboy.be/xboy-gift that would redirect you to https://gifts.xboy.be

This payment bypass is brought by the reliance of JavaSript to validate transactions.

function makePayment(data) {
            data['paymentMethod'] = $('.checkout__payment').html();
            $.ajax({
                method: "POST",
                url: "/v1/Payment",
                data: {paymentData: data},
                dataType: "JSON",
                success: function(response) {
                },
                error: function () {
                    alert('Ooops...');
                }
            }).then(action => {
                if (action == "Authorised") {
                    dropin.setStatus("success")
                    $.ajax({
                        method: "POST",
                        url: "/v1/HandleResponse",
                        data: {responseData: action},
                        dataType: "JSON",
                        success: function(response) {
                            window.location = response;
                        },
                        error: function (response) {
                            window.location = response;
                        }
                    });
                } else if (action == "Refused" || action == "Error") {
                    dropin.setStatus("error");
                    $.ajax({
                        method: "POST",
                        url: "/v1/HandleResponse",
                        data: {responseData: action},
                        dataType: "JSON",
                        success: function(response) {
                            window.location = response;
                        },
                        error: function (response) {
                            window.location = response;
                        }
                    });

The one is handled by gifts.xboy.be following the below procedure;

item added to cart == user info filled and goes to checkout == user select pay with card == user enters card == transaction performed == gifts.xboy.be checks server responses {The issue lies here} == User either get redirected to cart if transaction failed or confirmation page if transaction is successful

Successful Transaction

GET /v1/cart == POST /v1/Payment == [Response: 200 OK Data:"Authorised"] == POST /v1/HandleResponse == GET /confirmation

Unsuccessful Transaction

GET /nl/cart == POST /v1/Payment == [Response: 200 OK Data:"Refused"] == POST /nl/checkout/HandleResponse == GET /cart

Reproduction Steps:

1. connect burp with your prefered browser
2. go to https://gifts.xboy.be/ and add an item to your cart
3. proceed to https://gifts.xboy.be/cart and select checkout
4. follow the prompts to fill in all the required details and proceed to payment page.
5. select pay with card and add the test card "1337 1337 1337 1337" expiry data "03/30"
6. checkout first for camparisons sake and observe the failed checkout that redirected you to https://gifts.xboy.be/cart
7. go to payment again and do step 5 again but don't send request yet
8. Head over to burp and turn intercept on. send request now and make sure [POST /v1/Payment] request is captured by burp
9. right click and select intercept response to this request and forward request
10. observe the 200 OK response with the data "Refused" in the body.
11. Change "Refused" to "Authorised" and forward request, turn off intercept to
12. You should now recieve confirmation in mail

I made a report and sent it to the program and after a few days it got accepted as a high severity and Bounty €€€ awarded.

Contacts

@github @twitter @LinkedIn @Intigriti @hackerone_old