Business Logic Vulnerabilities

Business logic vulnerabilities are flaws in the design and implementation of an application that allows an attacker to elicit unintended behaviour.

In this context, the term "business logic" simply refers to the set of rules that define how the application operates.

As these rules aren't always directly related to a business, the associated vulnerabilities are also known as "application logic vulnerabilities" or simply "logic flaws".

Logic-based vulnerabilities can be extremely diverse and are often unique to the application and its specific functionality.

Business logic vulnerabilities often arise because the design and development teams make flawed assumptions about how users will interact with the application.

The impact of business logic vulnerabilities can, at times, be fairly trivial. It is a broad category and the impact is highly variable. However, any unintended behaviour can potentially lead to high-severity attacks if an attacker is able to manipulate the application in the right way.

Last updated