[Python] How can users modify cart prices using Burp Suite, and why is this a security risk in...

I recently discovered a serious security issue in Django e-commerce websites where users can modify product prices before adding items to the cart.

Many developers allow users to send price data from the frontend, which can be easily tampered with using Burp Suite or browser developer tools.

Example of the Issue:


Consider a simple Django view that adds items to the cart:

def add_item(request):
product_id = request.GET.get('product_id')
price = request.GET.get('price') # User-controlled value (security risk)
qty = int(request.GET.get('qty', 1))

cart_item = {
'product_id': product_id,
'qty': qty,
'price': price, # This price comes from the user, not the database!
}

request.session['cart'] = request.session.get('cart', {})
request.session['cart'][product_id] = cart_item
request.session.modified = True

return JsonResponse({'message': 'Added to cart'})

How an Attacker Can Exploit This:

1. A product costs $500 in the database.
2. The user clicks "Add to Cart".
3. Instead of sending the original price, the attacker intercepts the request using Burp Suite.
4. The price field is changed to $1, and the request is forwarded.
5. The cart now stores the manipulated price, and the user can proceed to checkout with the wrong amount.

Why Is This a Security Risk?

• The backend trusts data from the frontend, which can be easily manipulated.
• The session stores the wrong price, leading to financial loss.
• Attackers can buy expensive products at extremely low prices by modifying request data.

Discussion Points for the Community:

• What are the best practices to prevent this?
• Should e-commerce sites always fetch prices from the database instead of accepting them from the frontend?
• What other vulnerabilities should developers be aware of when handling cart data in Django?

Would love to hear your thoughts on this!

Continue reading...