CVE-2024-50654
📋 TL;DR
This vulnerability in lilishop e-commerce platform allows attackers to bypass coupon quantity limits during high-traffic periods by intercepting and replaying coupon collection requests. Attackers can obtain more coupons than allowed, potentially causing financial loss to merchants. All lilishop instances running vulnerable versions are affected.
💻 Affected Systems
- lilishop
📦 What is this software?
Lilishop by Pickmall
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deplete all available coupons, causing significant financial loss to merchants through excessive discounts and potentially disrupting promotional campaigns.
Likely Case
Attackers obtain more coupons than allowed, leading to moderate financial loss through unauthorized discounts and undermining coupon-based marketing strategies.
If Mitigated
With proper rate limiting and transaction validation, impact is limited to occasional successful bypass attempts with minimal financial consequences.
🎯 Exploit Status
Exploitation requires capturing network traffic during coupon collection and replaying requests under high concurrency conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: >4.2.4
Vendor Advisory: https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50654
Restart Required: Yes
Instructions:
1. Update lilishop to version >4.2.4. 2. Restart the application server. 3. Verify the fix by testing coupon collection under simulated high concurrency.
🔧 Temporary Workarounds
Implement Rate Limiting
allAdd rate limiting on coupon collection endpoints to prevent rapid repeated requests
# Configure rate limiting in web server or application firewall
Add Transaction Locking
allImplement database transaction locking for coupon allocation to prevent race conditions
# Implement optimistic/pessimistic locking in coupon allocation logic
🧯 If You Can't Patch
- Implement web application firewall rules to detect and block rapid coupon collection requests
- Monitor coupon usage patterns and set alerts for abnormal coupon acquisition rates
🔍 How to Verify
Check if Vulnerable:
Check if lilishop version is <=4.2.4 in admin panel or configuration filesCheck Version:
Check admin panel or config files for version informationVerify Fix Applied:
Test coupon collection under simulated high concurrency to ensure quantity limits are enforced📡 Detection & Monitoring
Log Indicators:
- Multiple coupon collection requests from same user/IP in short timeframe
- Coupon allocation exceeding quantity limits in transaction logs
Network Indicators:
- Rapid POST requests to coupon collection endpoints
- Repeated identical coupon request payloads
SIEM Query:
source="web_logs" AND (uri="/coupon/collect" OR uri="/coupon/redeem") AND count > 5 within 1s