Awesto Django-Shop Purchase Stock Handler Race Condition Vulnerability

A race condition vulnerability has been identified in Awesto Django-Shop versions through 1.2.4, specifically within the Purchase Stock Handler component. The issue arises from a non-atomic read-modify-write process in the checkout flow, allowing concurrent purchases of the last available unit to be processed simultaneously, leading to overselling. This vulnerability can be exploited remotely and is considered to have high complexity, although a public exploit is available.

Impact

Exploitation of this vulnerability can cause overselling of inventory, creating discrepancies between actual stock levels and recorded sales, which can disrupt order fulfillment processes.

Reproduction

To reproduce this vulnerability, create a product with a stock quantity of one. Add this product to the carts of two different users. Then, send two simultaneous checkout requests, such as concurrent POST requests to the '/shop/api/checkout/purchase' endpoint. Both requests will be processed successfully, despite only one unit being available, demonstrating the race condition in the stock deduction process.

Remediation

It is recommended to implement row-level locking or atomic conditional updates for stock deductions. This can be achieved by locking the inventory row during the checkout transaction or by updating the stock with a condition that ensures availability, such as 'quantity >= requested_quantity', and aborting the checkout if the update does not affect any rows. Additionally, a regression test for concurrent checkouts should be added to ensure the issue is addressed.