Zero Stars – Client-Side Validation Bypass

Abstract

This penetration test was conducted in a controlled laboratory environment using the OWASP Juice Shop application.
The objective of this challenge was to submit a zero-star customer rating, which is not permitted by the frontend user interface.

By intercepting and modifying an HTTP POST request with Burp Suite, the client-side validation was bypassed, allowing the submission of an invalid rating value.
This test highlights the risks of relying solely on client-side controls and demonstrates the importance of proper server-side validation.

Preparation Documentation

Identified Vulnerability / Vulnerabilities and Risk Assessment

• Identified Vulnerability: Missing server-side input validation
• Category: Improper Input Validation / Client-Side Trust
• Risk Assessment: Low to Medium
• Potential Impact:
  • Manipulation of user-generated content
  • Integrity issues in rating or reputation systems
  • Potential entry point for more severe injection-based attacks

Known Exploits

• No specific CVE is associated with this issue.
• This vulnerability class is widely documented in:
  • OWASP Top 10 – A04: Insecure Design
  • OWASP Testing Guide – Client-Side Controls
• Common exploit pattern: Parameter tampering via intercepted HTTP requests.

Execution of the Penetration Test

• Target Endpoint:
  POST http://localhost:3000/api/Feedback/

• Tools Used:

  • Burp Suite (Proxy / Intercept)
  • Integrated Juice Shop browser

• Testing Method:

  • Manual request interception and modification

• Assumptions and Constraints:

  • Test performed on a local Juice Shop instance
  • No authentication required for submitting feedback
  • Scope limited to the feedback functionality

Results Documentation

Accessible Information

• The intercepted request revealed:
  • CAPTCHA ID and solution
  • User comment and author
  • Rating value sent to the backend
• No sensitive data (credentials, tokens, configuration files) was exposed.

Exploitation Depth

• The vulnerability allowed direct manipulation of business logic data.
• Exploitation was limited to the feedback system.
• No lateral movement, privilege escalation, or further system access was possible.

Discovery Process

• Vulnerability discovered through manual testing.
• Observation that the frontend restricted rating values to 1–5 stars.
• Hypothesis that validation might be missing server-side.

Exploitation Process

1. Navigated to the Customer Feedback form.
2. Filled out the feedback form with a valid rating (e.g., 3 stars).
3. Enabled Intercept On in Burp Suite before submission.
4. Captured the outgoing POST request.
5. Modified the JSON payload:

   "rating": 3
   

   to:

   "rating": 0
   

6. Forwarded the manipulated request to the server.
7. Server accepted the invalid rating without validation.

Outcome

• A zero-star rating was successfully submitted.
• The challenge “Zero Stars” was completed.
• Demonstrated successful bypass of client-side restrictions.
• No additional system access was obtained.

Mitigation Measures

• Implement strict server-side input validation:
  • Enforce rating value range (e.g., 1–5) on the backend.
• Apply defensive programming principles:
  • Never trust client-side input.
• Return proper HTTP error responses for invalid payloads.

Recommendations and Prioritization

• Priority: Medium
• Fix server-side validation to ensure data integrity.
• Use centralized validation logic for all user inputs.
• Log and monitor invalid submission attempts for anomaly detection.