Executive summary
This case study details a security research project conducted by Rarefied, in accordance with Chase Bank's Responsible Disclosure Program, targeting Chase's online banking platform. Our objective was to identify vulnerabilities, analyze their potential impact, explore exploitation methods, and suggest mitigations.
Key outcome
A critical vulnerability was discovered that could allow an attacker to reimburse themselves for credit-card transactions at a fraction of the actual cost in reward points.
A fix for this issue has since been deployed by Chase Bank, and Rarefied retested the vulnerability to confirm remediation. Per Chase's policy, this remediation allows Rarefied to discuss the details of the vulnerability.
Introduction
In the evolving landscape of cybersecurity, continuous research is essential to uncover new vulnerabilities and develop effective countermeasures. This study focuses on a particular vulnerability discovered in Chase Bank's online banking platform, showcasing our research methodology, findings, and recommendations for mitigation.
Methodology
Our security research follows a systematic approach to ensure thorough analysis and validation of the vulnerability, across four key phases.
- Vulnerability discovery. Identifying potential weaknesses through manual inspection and automated tools.
- Proof-of-concept development. Creating a PoC to demonstrate the vulnerability's exploitability.
- Impact analysis. Assessing the potential impact of the vulnerability if exploited in a real-world scenario.
- Mitigation strategies. Proposing measures to mitigate the vulnerability via the organization's disclosure program.
Findings
Vulnerability overview
During our research, we identified a critical vulnerability in the Chase Rewards functionality. Left unaddressed, it could allow an attacker to effectively reimburse themselves for all credit-card transactions on their account.
Background
The vulnerability was found in the "Pay Yourself Back" feature of the Chase Rewards platform, at ultimaterewardspoints.chase.com/pay-yourself-back.
How it should work
The feature lets users redeem Chase Rewards points for statement credits. Buy a $10 coffee and pastry, and you could redeem 1,000 points for a $10 credit — reimbursing yourself for that transaction.
Proof of concept
The following steps demonstrate how the vulnerability could be exploited by manipulating the reward points required for a reimbursement.
Select a transaction to redeem — note the starting balance of 385,840 points — and continue.
Apply the full value of the transaction — it will legitimately cost 2,752 points, leaving a balance of 383,088.
Intercept the request with a proxy such as Burp Suite Pro. The loyaltyAmount parameter in the request body is 2752.
{
"externalTransactionIdentifier": "…",
"merchantName": "STORE*KIND CAFE & EATE",
"transactionAmount": 41.29,
"statementCreditAmount": 4129,
"selected": true,
"loyaltyAmount": 2752, // points to deduct — set by the client
"rewardsConversionRate": 0.015
}In the intercepted request, change the value from 2752 to something far lower — here, 200 — and forward it.
"loyaltyAmount": 2752 ———→ "loyaltyAmount": 200
The value of 200 persists through the transaction — only 200 points are debited. The new balance is 385,640.
The confirmation email matched these details, and the statement credit posted to the card — confirming end-to-end exploitation.
Impact analysis
Risk assessment — Critical
The vulnerability poses a critical risk due to the potential for significant financial loss. Immediate remediation was recommended.
The vulnerability could allow malicious users to:
- Reimburse themselves for transactions at a fraction of the actual cost in points.
- Exploit the system repeatedly for financial gain.
- Cause significant financial losses to the bank if exploited at scale.
Mitigation
Recommended control
Never trust user-supplied input when determining the validity of a transaction. Confirm the transaction server-side and ensure all credits and debits are accurate based on that authoritative record.
- Implement server-side validation of all transaction parameters.
- Add integrity checks so points deducted match the transaction value.
- Add authorization checks before processing reward redemptions.
- Monitor for unusual patterns in reward redemptions.
Conclusion
This case study highlights the importance of ongoing security research in identifying and mitigating vulnerabilities in online banking platforms. By understanding and addressing these issues, financial institutions can protect themselves against threats and strengthen their overall security posture.
Key takeaways
- Client-side validation should never be trusted for security-critical operations.
- Financial applications require rigorous server-side validation of all transactions.
- Responsible disclosure programs are essential for collaborative security improvement.
- Prompt remediation is critical to preventing exploitation.
Responsible disclosure
Rarefied adhered to Chase Bank's Responsible Disclosure Program throughout this project. All findings were reported responsibly, allowing Chase the opportunity to address the vulnerability before public disclosure; the terms of the program allow for this write-up. Rarefied was subsequently recognized by Chase Bank for reporting this vulnerability.
About Rarefied's research program
Rarefied conducts ongoing security research to identify vulnerabilities in widely-used systems and applications, improving the security of the digital ecosystem through responsible disclosure.