Add more seats by paying less via PUT /v2/seats request manipulation

How it was found

Summary:

I could not fully test this vulnerability because the test plan must be completed for the payment process, that is, 30 days. But the price value in api also changes and if payment is made according to this value, wrong billing will occur.

The annual pro option for Team plan billing is $60 per seat. However, if the user enters a decimal number instead of an integer while adding a seat, the number is rounded up, but the price is only multiplied by the integer part. For example it would be like this :

seats = 5
amount = 300
bady.seats = 1.1

seats += Math.ceil(bady.seats)
// 5  +=             2
// seats : 7 

amount += Math.floor(bady.seats) * 60
// 300 +=                 1      * 60
// amount : 360 

Steps To Reproduce:

• Register the app and finish the installation. help document
• Create a new team.
• Go to billing and listen to traffic with burp.
• Add seat and capture the request with burp.
• Replace the number of seats with 1.9
• You will see that you have added 2 seats but the price has increased by $60.

We can reduce the price by adding and deleting seats.

Poc video -|

{F1574747}

Impact

Attacker can manipulate membership price