Business Logic Vulnerabilities

What it is

Business logic vulnerabilities are flaws in application design that allow attackers to manipulate legitimate functionality in unintended ways. Unlike technical vulnerabilities, these flaws are application-specific and require understanding the application's purpose. Examples include negative quantity abuse, price manipulation, workflow bypass, and privilege escalation through role assignment.

Attack Vectors

• Shopping cart and payment flows
• Coupon and discount code systems
• Role and permission assignment
• Multi-step workflows (checkout, registration)
• Transfer and financial operations
• Rate-limited features

Testing Methodology

1. Manipulate quantity or price values (negative quantities, zero prices)
2. Apply multiple discount codes or re-apply single-use coupons
3. Skip steps in multi-step workflows
4. Test for race conditions in concurrent requests
5. Tamper with hidden form fields containing pricing or role data

Indicators of Vulnerability

• Negative balance or price achieves unintended benefit
• Multi-step workflow completed without completing all steps
• Resource accessed beyond intended rate limit via race condition

Detection Guidance

Implement server-side validation for all business rules. Log anomalous transaction patterns. Monitor for negative values, unusually low prices, or concurrent duplicate requests.

Mitigation & Remediation

• Implement all business rule validations on the server side, never relying on client-side controls
• Validate data integrity at each step of multi-step workflows
• Use atomic database transactions to prevent race conditions
• Implement idempotency checks for critical operations
• Apply rate limiting and duplicate request detection

References

• PortSwigger Business Logic Vulnerabilities
• OWASP Business Logic Testing
• OWASP Hunting — Business Logic Vulnerabilities (upstream)