- Status Closed
-
Assigned To
cbay - Private
Opened by waloodi_109 - 03.07.2025
Last edited by cbay - 03.07.2025
FS#188 - # No limit in email length may result in a possible DOS attack in admin.alwaysdata.com
#No limit in email length may result in a possible DOS attack in admin.alwaysdata.com
From the page: https://admin.alwaysdata.com/profile When I tried to update the email address, I noticed that the database field was allocating 255 characters there and if the input was more than 255 character that field was truncating.
For example:
haxorsistz+axorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxoailrsistzh@gmail.com
You will see that the long email is readily accepted and there is no fixed length for this user input parameter.
Mitigation: The email parameter must have a specific user input length
Impact
An attacker can store a large email address as per his requirement which will possibly lead to a DOS attack / Buffer Overflow.
Thank You,
Waleed Anwar
Loading...
Available keyboard shortcuts
- Alt + ⇧ Shift + l Login Dialog / Logout
- Alt + ⇧ Shift + a Add new task
- Alt + ⇧ Shift + m My searches
- Alt + ⇧ Shift + t focus taskid search
Tasklist
- o open selected task
- j move cursor down
- k move cursor up
Task Details
- n Next task
- p Previous task
- Alt + ⇧ Shift + e ↵ Enter Edit this task
- Alt + ⇧ Shift + w watch task
- Alt + ⇧ Shift + y Close Task
Task Editing
- Alt + ⇧ Shift + s save task
Hello,
The HTML input type does have a maxlength limit.
That's not true.
Kind regards,
Cyril
Input haxorsistz+axorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxorsistzhaxoailrsistzh@gmail.com
then submit the request it should show 500 error.
I tried and didn't get any 500 error. Can you share a video showing it?
Yeah,I will share with you
There is a link
https://www.dropbox.com/scl/fi/a8g0t57wnwio04dwyney0/bandicam-2025-07-04-02-28-15-214.mp4?rlkey=6s34dknsrywzvoy70pqgbpsb6&st=mpg4lkej&dl=0
Thanks, that was a harmless bug.
You Should have to fix this because attacker can inject a payload in between it.
Can you prove it?
I tried it's accepting base64 encoding payload but not reflecting, and you fixed it without giving me a bounty that's not fair Sir
I fixed the 500 error that you reported, but it was not a security issue.
Next time, I suggest you simply do your research before submitting the report.
I clearly Submitted the report that was 500 error bug that was fixed by you, "attacker can inject a payload in between it" that was my opinion only.
Reference: https://huntr.com/bounties/733678b9-daa1-4d6a-875a-382fa09a6e38
The same report which is valid for https://admin.alwaysdata.com/permissions/add/