- Status Closed
-
Assigned To
cbay - Private
Opened by waloodi_109 - 30.10.2024
Last edited by cbay - 31.10.2024
FS#91 - No Rate Limit on account deletion request
No Rate Limit on account deletion request(Leads to Password Guessing)
Hello Team, I hope you are doing well.
I found this vulnerability in your website Business Logic Errors
Referrer: https://admin.alwaysdata.com/admin/details/357258/delete/
*Description :
No Rate Limit is a type of computer security vulnerability typically found in web applications. No Rate Limit enables attackers to perform actions on the web application where the attacker can do signup creation, password reset or 2FA of other users. No Rate Limit vulnerability may be used by attackers to bypass access controls such & bruteforce tokens and passwords without any limiting of any requests. There should be protection on the web application for sensitive actions. Attackers send a high number of requests to perform desirable actions to get access to the application or accounts.
NO RL effects vary in range from petty nuisance to significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner network.
*Steps to Reproduce:
1. Go to https://admin.alwaysdata.com/admin/details/357258/delete/
2. Intercept This Request In Burp And Forward Till You Found Your Number In
3 Now Send This Request To Intruder And Repeat It 250 Time By Fixing Any Arbitrary Payload Which Doesn't No Effect Request I Choose Accept-Language: en-US,en;q=0.$5$ and payload set null 250 and start attack.
Note:-
Ofcourse, generating account deletion emails is possible if an attacker gets control over user's account (or) it may be possible if any other vulnerabilities are discovered in future.
Thanks,
Waleed Anwar
Loading...
Available keyboard shortcuts
- Alt + ⇧ Shift + l Login Dialog / Logout
- Alt + ⇧ Shift + a Add new task
- Alt + ⇧ Shift + m My searches
- Alt + ⇧ Shift + t focus taskid search
Tasklist
- o open selected task
- j move cursor down
- k move cursor up
Task Details
- n Next task
- p Previous task
- Alt + ⇧ Shift + e ↵ Enter Edit this task
- Alt + ⇧ Shift + w watch task
- Alt + ⇧ Shift + y Close Task
Task Editing
- Alt + ⇧ Shift + s save task
Hello,
Deleting your profile will delete all your accounts in a single request, so really there's no point rate limiting account deletion requests.
Kind regards,
Cyril
Yeah, you are right, deletion of account will be deleted in a single request but in email you can see there is so many requests available in email, so its flood to email bombing and business impact.