MapperPlus

From the acme.com demo workspace. Acme is not a real company.

MP-1842CriticalFix proposed

Payment bypass: the order ships even when nothing is charged.

Asset
pay.acme.com
Endpoint
POST /v1/checkout/capture
Found by
Autonomous pentest
Code
checkout/capture.ts, line 49

What happened

A coupon applied to an order skips the payment capture. Checkout still marks the order as shipped. Anyone with a coupon code can receive goods without being charged.

Proof

The requests below were sent to the live system and replayed until the result was the same each time.

  1. 1
    POST /v1/orders
{ "items": ["sku_2041"], "total": 49.00 }

    201 { "id": "ord_7Q2", "status": "pending" }

  2. 2
    POST /v1/orders/ord_7Q2/coupon
{ "code": "WELCOME10" }

    200 { "status": "pending", "charged": false }

  3. 3
    POST /v1/checkout/capture
{ "order": "ord_7Q2" }

    200 { "status": "shipped" }

Payment gateway: no charge recorded for ord_7Q2. Reproduced 3 of 3.

The fix

The coupon branch returned before the charge was captured. The change captures first and rejects the order when nothing was charged.

checkout/capture.ts

+3−1

48 async function capture(order) {
49−if (order.coupon) return fulfill(order)
49+const charged = await gateway.capture(order.total)
50+if (!charged || order.total <= 0) return reject(order)
51+return fulfill(order)
52 }

Fixed by MapperPlus · a coupon can no longer complete checkout without a captured charge.

Timeline

  1. 09:14pay.acme.com appears in DNS and is added to the map.
  2. 09:15Autonomous pentest starts on the new host.
  3. 09:21Payment bypass reproduced 3 of 3 times.
  4. 09:24Traced to checkout/capture.ts, line 49.
  5. 09:26Merge request opened in GitLab with the fix.
  6. NextYour engineers review, merge, and release it.

See what MapperPlus finds on yours.

Enter your domain. We map what is exposed and walk you through it in a live demo.

ISO 27001 certifiedNothing to installYour team merges every fix