How I Created 20 Super-Admins in 1 Second: Exploiting a Race Condition in Querybook
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A security researcher discovered a TOCTOU (Time-of-Check to Time-of-Use) race condition in Querybook, Pinterest's open-source big data IDE. The flaw exists in the initial setup logic: the first registered user is granted admin rights, but without database-level locking or atomicity, concurrent signup requests all see zero admins and all get promoted. Using Python's threading.Barrier, the researcher fired 20 simultaneous POST requests to the signup endpoint, successfully creating 20 super-admin accounts at the same timestamp. The bug was reported via Bugcrowd but marked N/A because Querybook is an internal tool with a narrow exploitation window. The post debates this outcome through a Zero Trust lens, arguing insider threats and permanent post-exploitation impact make the flaw significant regardless of deployment context. The fix: use atomic database operations, SELECT FOR UPDATE locks, or mutexes around critical read-then-write initialization logic.
