Pentest Findings: Bypassing Freemium through client-side security controls

Pentest Findings: Bypassing Freemium through client-side security controls

Never rely on client-side controls to enforce core security functions!

Conor O'Neill
Conor O'Neill
Chief Product Officer
October 13, 2022

Welcome to our Pentest Files blog series.

Each blog post will present an interesting or dangerous finding one of our testers has identified in an actual recent pen-test, so you can see the kinds of cool things our pen-testers get up to, and also to help you take steps to prevent similar vulnerabilities in your own assets.

These findings are taken from real reports, anonymised, and published with kind permission from our clients.

Tester: Adam

Target: Web application

Vertical: Fintech

Impact: Loss of potential upgrade revenue

What Happened?

Adam found that server-side security controls hadn’t been enabled in our customer’s target application, meaning he could access features which should have been reserved for paying customers.

Some Background

We often find that some of our clients are relying on client-side security controls to enforce key security features.

Unfortunately for them, it’s often overlooked that client-side controls can be fully manipulated by the end users, and therefore easily bypassed.

Combining this with inadequate access control checks when calling backend API functions, a user with only a Freemium subscription to the application could access additional features which were reserved for paying customers.

The Finding

While logged in as a Freemium user, during the webapp test Adam accessed the user’s account page and attempted to access a paid-for feature. A ‘paywall modal’ was displayed, seemingly preventing Adam from accessing these perks.

Crucially though, Adam was easily able to determine that this paywall modal was actually only a client-side ‘security’ measure. Client-side measures are executed, and therefore validated, by the client themselves, so the user would actually have full control over the paywall modal. They could easily bypass the normal procedure of validating the user’s subscription level via a server.

Once he disabled the paywall modal, Adam then attempted to execute one of the underlying paid-for functions, which was provided via supporting API backend. It was found that there were no ‘backed’ server-side access control checks, and therefore it was possible to make a request which should not have been possible for a Freemium user.

In fact, there were no server-side controls on any of the upgrade features, meaning that any user could access every restricted feature - whether they’d paid or not!

The Fix

The ‘Golden Rule’ of application security: Never rely on client-side controls to enforce core security functions!

These can be trivially bypassed, so always make sure suitable access control checks are applied to all application functions. This way, you know for sure that the users making these requests have appropriate permissions (and are paying!) to do so.

Bedtime Reading

Want to check that your application is free from this kind of vulnerability? Why not get a quote or contact us  to set up a pentest.

More recommended articles

© 2022 ONSECURITY TECHNOLOGY LIMITED (company registered in England and Wales. Registered number: 14184026 Registered office: Floor T, Castlemead, Lower Castle Street, Bristol, England, BS1 3AG). All rights reserved.