Smashing the State Machine: The True Potential of Web Race Conditions
PortSwigger Research Director James Kettle publishes a comprehensive analysis revealing the underestimated potential of web race condition attacks. Historically, security focus has been limited to simple limit-overrun scenarios, such as redeeming gift cards multiple times. This research introduces new classes of race conditions that exploit complex state machines in web applications, going far beyond traditional time-of-check-time-of-use flaws. Kettle demonstrates these vulnerabilities by exploiting high-profile websites and Devise, a popular Ruby on Rails authentication framework. A key innovation presented is the single-packet attack, a technique designed to bypass network jitter by synchronizing requests within a sub-millisecond window, effectively squeezing thirty requests from Melbourne to Dublin into a tiny execution frame. The paper argues that because web applications handle concurrent requests via shared databases without adequate concurrency safeguards, almost every multi-step workflow is potentially vulnerable. To support practical learning, the research is accompanied by free online labs and was presented at major security conferences including Black Hat USA and DEF CON. This work aims to provide developers and pentesters with advanced methodologies for identifying and mitigating these sophisticated concurrency risks.
Wire timeline
Smashing the State Machine: The True Potential of Web Race Conditions
PortSwigger Research Director James Kettle publishes a comprehensive analysis revealing the underestimated potential of web race condition attacks. Historically, security focus has been limited to simple limit-overrun scenarios, such as redeeming gift cards multiple times. This research introduces new classes of race conditions that exploit complex state machines in web applications, going far beyond traditional time-of-check-time-of-use flaws. Kettle demonstrates these vulnerabilities by exploiting high-profile websites and Devise, a popular Ruby on Rails authentication framework. A key innovation presented is the single-packet attack, a technique designed to bypass network jitter by synchronizing requests within a sub-millisecond window, effectively squeezing thirty requests from Melbourne to Dublin into a tiny execution frame. The paper argues that because web applications handle concurrent requests via shared databases without adequate concurrency safeguards, almost every multi-step workflow is potentially vulnerable. To support practical learning, the research is accompanied by free online labs and was presented at major security conferences including Black Hat USA and DEF CON. This work aims to provide developers and pentesters with advanced methodologies for identifying and mitigating these sophisticated concurrency risks.
PortSwigger Research