# Persistent CSRF in /GiftCert-AddToBasket prevents purchases on eCommerce sites

Unauthenticated CSRF on Teavana's GiftCert-AddToBasket endpoint lets an attacker add a gift card to a victim's cart, permanently blocking checkout and credit card payment.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: inhibitor181
- Disclosed: 2017-05-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/206319
- Library page: https://bugbountylibrary.com/r/h1%3A206319
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:high tech:payment vuln:business-logic vuln:csrf

**Target:** Demandware eCommerce GiftCert-AddToBasket endpoint
**Root cause:** The GiftCert-AddToBasket POST endpoint lacks CSRF protection, and once a gift certificate is in the cart the cart cannot be emptied and the credit card payment option disappears, persisting across sessions.
**Steps:**
1. Discover hidden Demandware endpoint `/on/demandware.store/Sites-Teavana-Site/default/GiftCert-Purchase`
2. Note the gift card add-to-cart POST is not CSRF protected
3. Craft an auto-submitting HTML form POSTing `dwfrm_giftcert_purchase_amount=100` and recipient fields to `/GiftCert-AddToBasket`
4. Victim visits attacker page; gift card is added to their cart
5. Victim can no longer empty cart or select credit card payment, blocking all future orders
**How found:** Researcher was enumerating hidden demandware.store links and found the GiftCert-Purchase page; noticed the add-to-cart POST lacked CSRF protection, then observed that adding a gift card broke cart emptying and removed the credit card option, persisting across logout/login.
**Exploitation:** Attacker hosts an HTML page with an auto-submitting form targeting the victim's Teavana session; on visit the gift certificate is added to the victim's cart, which cannot be removed and disables the credit card payment method, permanently preventing checkout.
**Insight:** Hidden Demandware storefront endpoints (GiftCert-*, etc.) often lack CSRF tokens; test whether state-changing cart operations have side effects that persist server-side and cannot be undone by the user, turning a low-impact CSRF into a denial-of-business.