Description
DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| harung1993 | dollardollar | ≤ 4.4 | — |
References
- GitHub Issue #125 issue-tracking
- https://github.com/harung1993/dollardollar product
- https://github.com/harung1993/dollardollar/blob/v4.4/app.py#L4298 technical-description
- VulnCheck Advisory: DollarDollar through 4.4 Missing Authorization in /add_expense Balance Tampering third-party-advisory