This vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in https://github.com/akinloluwami/outray/blob/main/apps/web/src/routes/api/%24orgSlug/subdomains/index.ts
//Race condition
const [subscription] = await db
.select()
.from(subscriptions)
.where(eq(subscriptions.organizationId, organization.id));
const currentPlan = subscription?.plan || "free";
const planLimits = getPlanLimits(currentPlan as any);
const subdomainLimit = planLimits.maxSubdomains;
const existingSubdomains = await db
.select()
.from(subdomains)
.where(eq(subdomains.organizationId, organization.id));
if (existingSubdomains.length >= subdomainLimit) {
return json(
{
error: `Subdomain limit reached. The ${currentPlan} plan allows ${subdomainLimit} subdomain${subdomainLimit > 1 ? "s" : ""}.`,
},
{ status: 403 },
);
}
const existing = await db
.select()
.from(subdomains)
.where(eq(subdomains.subdomain, subdomain))
.limit(1);
if (existing.length > 0) {
return json({ error: "Subdomain already taken" }, { status: 409 });
}
const [newSubdomain] = await db
.insert(subdomains)
.values({
id: crypto.randomUUID(),
subdomain,
organizationId: organization.id,
userId: session.user.id,
})
.returning();if (existingSubdomains.length >= subdomainLimit) {
return json(
{
error: `Subdomain limit reached. The ${currentPlan} plan allows ${subdomainLimit} subdomain${subdomainLimit > 1 ? "s" : ""}.`,
},
{ status: 403 },
);
}const [newSubdomain] = await db
.insert(subdomains)
.values({
id: crypto.randomUUID(),
subdomain,
organizationId: organization.id,
userId: session.user.id,
})
.returning(); Parallel request 1 Parallel Request 2
| |
checks for Checks the not yet updated
available subdomain row and bypasses the logic checks
and determines if it is more than limit
| |
Inserts subdomain and calls it a day Also inserts the subdomain
The vulnerability provides an infiinite supply of domains to users bypassing the need for subscription
SENSEiXENUS Reporter
gr33pp Analyst
Summary
This vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in
https://github.com/akinloluwami/outray/blob/main/apps/web/src/routes/api/%24orgSlug/subdomains/index.tsDetails
subdomainsbefore theINSERTstatement of request one is made.It allows the attacker to act on a not yet updated row which bypasses the checks and allow the attacker to get more subdomains.For example-:PoC
Repeaterand create multiple requests in a single batch with different subdomain names as seen below. Lastly, send the requests inparallel.Impact
The vulnerability provides an infiinite supply of domains to users bypassing the need for subscription