This article discusses a critical vulnerability found in a cinema booking system, where an attacker can exploit the booking process to monopolize all available seats through the manipulation of temporary transaction IDs and booking IDs. The vulnerability poses significant risks, including denial of service, financial losses, reputational damage, and operational disruptions for businesses. Affected: cinema booking systems
Keypoints :
- Online booking systems are convenient but susceptible to vulnerabilities.
- A flaw in the cinema booking system allows attackers to generate multiple unique booking IDs using a single temporary transaction ID.
- The system’s settings permit reservations to expire after 10 minutes, which can be automated by attackers.
- Attackers can monopolize all available seats, leading to a denial-of-service scenario affecting legitimate users.
- Unauthorized control over seat availability occurs when attackers can guess or obtain transaction IDs.
- Testing revealed that it is possible to book more than the intended maximum of seats.
- The impact of this vulnerability can lead to financial losses and reputational damage for the cinema.
- Companies must prioritize security in online booking systems to prevent such exploitations.
MITRE Techniques :
- T1071.001 – Application Layer Protocol: The attacker uses HTTP POST requests with crafted payloads to manipulate seat bookings.
- T1110.001 – Brute Force: Multiple booking IDs are generated using a brute-force method to reserve seats.
- T1203 – Exploitation for Client Execution: The attacker leverages the vulnerabilities in the booking system’s handling of transaction IDs for unauthorized seat reservations.
- T1499 – Denial of Service: The exploitation leads to a denial-of-service situation for legitimate users trying to book seats.
Indicator of Compromise :
- [HTTP Request] POST /v2/movies/add-seat?version=3&site_id=6&channel=web&child_site_id=370&client_id=
- [HTTP Request] POST /v1/movies/set-seat?version=3&site_id=6&channel=web&child_site_id=370&client_id=
- [HTTP Request] POST /v1/movies/release-seats?version=3&site_id=6&channel=web&child_site_id=370&client_id=
- [Hash] tempTransId: “3feb8964ea8f12955068e2719238c410c34c8865901e554ea6091f9efa685f47”
- [Hash] bookingId: “5359e6bc3717cc75b13d41bc5bf5c7b76bbea04028ca3999c39054598dba2ec3”