Authorized Web Audit: When the App Has No Backend, You Audit Its Assumptions

In a small web store audit, security researchers found no backend to exploit, so they focused on identifier manipulation and clickjacking. The store was built on Vercel, using React and Vite for a single page application (SPA). The team conducted reconnaissance, including checking robots.txt, sitemap.xml, routes, and HTTP headers, but found no vulnerabilities or administrative interfaces.

Upon realizing there was no server or database, the researchers shifted their focus to the app's assumptions. They manipulated product identifiers within the store's flows, which revealed that out-of-stock products could be accessed by altering the ID. Additionally, share-cart URLs could be manipulated to display sold-out items, indicating insufficient business logic validation.

The team also discovered that the app could be framed, meaning it could be embedded in other websites. They created a proof-of-concept (PoC) by loading the tampered cart URL within an iframe and overlaying their own visual elements. This demonstrated that the store was embeddable and that an attacker could create a deceptive experience for users.

The researchers highlighted the business implications, such as price/availability confusion, loss of trust, and visual impersonation, which could harm legitimate businesses. They recommended implementing the X-Frame-Options: DENY header or a Content-Security-Policy (CSP) with frame-ancestors set to none, and emphasized the importance of validating availability on every flow rather than trusting client data.

The audit concluded that the application's architecture, despite being built with a modern JavaScript stack (React + Vite), presented a larger attack surface than initially anticipated. They advised that scanners often miss business logic vulnerabilities, and it's crucial for security professionals to ask critical questions, such as "What happens if I use this functionality in a way the developer didn't expect?"