Collected research
A Race to the Bottom - Database Transactions Undermining Your AppSec
Reading a row, checking it, then writing it inside a database transaction is still racy: default isolation levels take no lock on the read, so concurrent requests all pass the check. Firing parallel requests, ideally with last-byte sync or a single-packet attack, lets an attacker overdraw a balance or push business logic past its intended limits.
Record
- Researcher
- Viktor Chuchurski
- Published by
- blog.doyensec.com
- Topic
- Other
In the archive
Related sources
- Database race-condition playground
- OWASP Global AppSec Lisbon slides Whitepaper
- A Race To The Bottom: Database Transactions Undermining Your AppSec - Viktor Chuchurski
- No Hat 2024 - Viktor Chuchurski - A Race to the Bottom - Database Transactions Undermining Your ...
Tags
This page is the archive's own catalogue record. The research is the work of Viktor Chuchurski, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .