Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase
业务逻辑 / TOCTOU 竞态条件 / #801743
该报告还没有中文解读。
原文摘录
摘自原文（2140 字符中的一小部分）
Summary: When we purchase coins from Reddit's mobile app using Android, https://oauth.reddit.com/api/v2/gold/android/verify_purchase is called with parameters like `transaction_id` and `token`. There exists a race condition on this endpoint which allows an attacker to get coins many times more than …
原文中的代码
POST /api/v2/gold/android/verify_purchase?raw_json=1&feature=link_preview&sr_detail=true&expand_srs=true&from_detail=true&api_type=json&raw_json=1&always_show_media=1&request_timestamp=1582296187715 HTTP/1.1 Authorization: Bearer REDACTED Client-Vendor-ID: REDACTED x-reddit-device-id: REDACTED …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Reddit 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @yashrs · 版权归作者与 Reddit 所有