How Referral Programs Work Under the Hood

▶ Watch (0:02)

Taylor identified four implementation patterns. The first stores the referral code in a cookie extracted from the URL. The second uses client-side AJAX requests to validate and apply the code before sign-up. The third treats referral codes as promo codes during checkout. The fourth relies on Android intents to pass referral data between apps. Companies including Google, HelloFresh, Robinhood, and Etsy use one of these patterns.

▶ Watch (5:59)

When applications drop the referral code into a cookie without validation, an attacker can inject special characters to break out of the cookie value. This enables cookie tossing (set arbitrary cookies on the site), cookie fixation (control the path attribute), or cookie bombing (overflow the cookie jar to break requests). Taylor also found client-side path reversal, where the referral code is concatenated into a fetch URL. A path traversal sequence lets the attacker redirect the API call to an arbitrary endpoint, enabling XSS or CSRF bypass.

Business Logic Flaws: Infinite Credit, Bypass, and Self-Referral

▶ Watch (8:12)

One program allowed alias emails (user+1@gmail.com) and required no prior referral activity. The reward per referral exceeded the spending requirement. Taylor created two accounts, referred each other repeatedly using credit, and never spent real money again. He generated thousands of dollars of store credit. The bounty was $150. Another program required an order before a referral code unlocked. Taylor placed a scheduled order, used the code on a second account, then cancelled the first order. That bug paid $0 after three months of ignored messages. A third program let attackers use their own referral code as a promo code, giving 50% off each billing cycle indefinitely.

Race Conditions and Referral Hijacking

▶ Watch (13:03)

On a financial app, a race condition in the referral application flow allowed Taylor to send parallel requests using James Kettle’s single-packet attack. He generated multiple rewards from a single referral. The program refused to verify the attack because it required social security numbers to create duplicate accounts. Taylor also demonstrated referral hijacking via cookie fixation: by injecting a cookie with a more specific path, his attacker cookie took priority over the legitimate referrer’s cookie. And on Android, a malicious app disguised as Gmail could intercept the referral intent, swap the code, and pass it on without the user noticing.

Q&A

Would you go the Sam Curry route and publish a full disclosure article? Taylor said probably. ▶ 20:02

What did you miss in your targeting? Business logic errors are vast and application-specific; he stopped after 25 submissions but believes the most bugs remain in that area. ▶ 20:16

Notable Quotes

I was able to generate thousands of dollars of credit on this particular application. And the program rewarded me with $150 bounty. Whit “un1tycyb3r” Taylor · ▶ 9:48

This bug rendered no bounty. A triager told me that there was no CIA impact and ignored my messages for about 3 months until I gave up and it is currently in the mediation black hole. Whit “un1tycyb3r” Taylor · ▶ 11:20

they told me that there’s no possible way that I was going to get those rewards anyways. And so they told me to f off, but they ended up fixing it about, I don’t know, a week later. Whit “un1tycyb3r” Taylor · ▶ 14:17

I made less than $1,000 in bounties. Um, really, really frustrating experience. You know, bug bounty is a scam. Whit “un1tycyb3r” Taylor · ▶ 17:17

Key Takeaways

  • Referral reward programs are an underexplored attack surface with direct financial impact.
  • Cookie injection and client-side path reversal are common due to poor input validation.
  • Business logic flaws like infinite credit loops reward attackers more than the bug bounty does.

About the Speaker(s)

Whit “un1tycyb3r” Taylor is an application pentester at Rhino Security Labs with over a decade of security experience. He specializes in web and Android application security, bug bounty hunting, and open-source research. His findings include a critical unauthenticated RCE in Appsmith Enterprise Edition.