[pentest] Burn-after-read counter race: single-read paste can be fetched multiple times concurrently #64

Closed
opened 2026-09-09 14:10:09 +00:00 by poslop · 0 comments
Owner

A paste created with burn_after_read: true, burn_after_reads: 1 can be read more than once under concurrent requests - the burn counter decrement is not atomic (TOCTOU).

Repro: create 1-read burn paste, fire ~15-20 parallel GETs to /raw/{id}:

  • Run 1: 3x HTTP 200, 17x 404
  • Run 2: 2x HTTP 200, 13x 404

Expected: exactly one 200. Content meant to self-destruct after one read is delivered to multiple readers.

A paste created with `burn_after_read: true, burn_after_reads: 1` can be read more than once under concurrent requests - the burn counter decrement is not atomic (TOCTOU). Repro: create 1-read burn paste, fire ~15-20 parallel GETs to /raw/{id}: - Run 1: 3x HTTP 200, 17x 404 - Run 2: 2x HTTP 200, 13x 404 Expected: exactly one 200. Content meant to self-destruct after one read is delivered to multiple readers.
Sign in to join this conversation.