Workflow Step Bypass

Detects multi-step workflows where step validation relies on client-side state or is insufficiently enforced server-side.

zakirkun 6bde711 2 files · 2.1 KB Updated

File contents

Workflow Step Bypass

Overview

Multi-step processes (checkout, registration, password reset, onboarding) where step progression is enforced only by client-side state or easily-manipulated tokens can be bypassed. Attackers jump directly to final steps (e.g., payment confirmation without paying, account activation without email verification).

Remediation

  • Store workflow step state server-side, not in client cookies/form fields
  • Verify each step's prerequisites before proceeding
  • Use server-side session to track workflow progress

zakirkun/ice-tea/tree/main/skills/business-logic/workflow-bypass commit 6bde711eb8

Frequently asked questions

npx skillmds@latest add zakirkun/workflow-step-bypass