# OK.ru: client-controlled st.appPrice underpays music purchases

OK.ru music purchase trusted client-supplied st.appPrice in the payment URL, letting users buy songs for 1-2 OK instead of the real price.

- Payout: hidden
- Severity: medium
- Program: ok.ru
- Found by: 4lemon
- Disclosed: 2016-04-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/78219
- Library page: https://bugbountylibrary.com/r/h1%3A78219
- Tags: area:web domain:web impact:funds-loss kind:bounty platform:hackerone sev:medium tech:payment vuln:business-logic

**Target:** Music purchase payment gateway (paymentnew.ok.ru /dk richPayment)
**Root cause:** The st.appPrice parameter in the payment redirect URL is not covered by the request signature and is not validated server-side against the actual product price.
**Steps:**
1. Request `GET /isDownloaded;jsessionid=...?tid=90920917758231` and observe JSON with `"price":10,"isBought":false`.
2. In Burp, set an automatic response replacement changing `"price":10` to `"price":1` so the client shows the lower price.
3. Click Buy; the client opens `https://paymentnew.ok.ru/dk?st.cmd=richPayment&...&st.appCode=90920917758231&st.currency=OK&st.appPrice=1&st.callback=true&st.srv=22`.
4. Modify `st.appPrice` in the URL (e.g. to 2); the request integrity is unaffected.
5. Complete payment via WebMoney; notification shows 'Вы получили 2 OK' and the song appears under 'My purchases'.
**How found:** Noticed the price came from a client-side JSON response and that the payment URL carried st.appPrice, then tested whether editing it broke request integrity.
**Exploitation:** Attacker lowers the displayed price via response tampering, then edits st.appPrice in the payment gateway URL to pay a fraction of the real price; the gateway accepts the unsigned value and credits the purchase.
**Insight:** When a purchase flow redirects to a payment gateway, check whether the price/amount parameter is inside the signed payload; tamper it and see if the gateway still accepts the request.