[pentest] Burn-after-read counter race: single-read paste can be fetched multiple times concurrently #62

Closed
opened 2026-09-09 14:09:35 +00:00 by poslop · 1 comment
Owner

Severity: High

A paste created with burn_after_read: true, burn_after_reads: 1 can be read more than once when requests arrive concurrently — the burn counter is decremented non-atomically.

Repro: create 1-read burn paste, then fire ~15-20 parallel GETs to /raw/{id}:

  • Run 1: 3x HTTP 200, 17x 404
  • Run 2: 2x HTTP 200, 13x 404

Expected: exactly one 200. Impact: content intended to self-destruct after one read is delivered to multiple readers. Likely a read-then-decrement race (TOCTOU) in the burn handler.

Verified on dev build 2026-09-09, blind black-box test.

**Severity: High** A paste created with `burn_after_read: true, burn_after_reads: 1` can be read more than once when requests arrive concurrently — the burn counter is decremented non-atomically. Repro: create 1-read burn paste, then fire ~15-20 parallel GETs to /raw/{id}: - Run 1: 3x HTTP 200, 17x 404 - Run 2: 2x HTTP 200, 13x 404 Expected: exactly one 200. Impact: content intended to self-destruct after one read is delivered to multiple readers. Likely a read-then-decrement race (TOCTOU) in the burn handler. Verified on dev build 2026-09-09, blind black-box test.
Author
Owner

Duplicate of #58 (burn-after-read race, found in the #34 sweep and already assigned to a fix branch). Keeping #58 as the tracking issue. The pentest repro confirms the MED finding from #34.

Duplicate of #58 (burn-after-read race, found in the #34 sweep and already assigned to a fix branch). Keeping #58 as the tracking issue. The pentest repro confirms the MED finding from #34.
Sign in to join this conversation.