[Reddit] Bug Allows Purchasing Coins for Less Than Expected Money ($500 USD)

We discussed this vulnerability during Episode 93 on 25 October 2021

Reddit had an issue in associating transactions and order information. If you initiated a coin purchase for say $1.99, the order will be created and the order ID can be obtained. If you cancel that order, and then make a new one for a larger purchase but swap out the order_id in the response to creating the order. The redirect to Paypal will be for the original order’s amount but Reddit will have associated it with a larger coin ammount.

While the report doesn’t disclose the root cause of this bug, since the order is created and the order id is returned it is possibly then used in a follow-up request that creates the paypal transaction and mixes knowledge sources up. Where it draws some information from the current session and the transaction being performed, and other information from an order lookup. So it would be reading the number of coins associated with the paypal transaction from the session, but the cost might have been set when creating the paypal transaction earlier. Not sure, its a bit of a weird bug to have.