Comments (1)
threatLevel="Low" type="Insufficient Abuse Mitigation">
There is no limit on the number of forms a user can submit by (ab)using the "Resend Verification E-mail" functionality. Due to this it was possible to send 60 mails in two minutes.
impact:
Lack of rate limits allows attackers / spammers to take advantage of the
web / mail server capacity using automated tools. This is exacerbated by
the fact that attackers can add their own files (see also
Anonymous file upload). This in turn could also lead to
the mail infrastructure that Red Cross uses will be flagged as
malicious, and could be banned by spam filters.
recommendation:
Implement reasonable rate limits on the server side, where a unique IP
address can only subscribe a reasonable number of times in a set
time frame.
Do not allow cookies or other parameters to be replayed, but require a
unique 'token' per form submission.
from audit.
Related Issues (20)
- Missing Terms of Service and Privacy Policy HOT 2
- SSL Medium and RC4 Ciphers supported HOT 1
- Frameable response (potential Clickjacking) HOT 1
- Use any e-mail-address as the issuers address. HOT 4
- Hardcoded Unsubscribe token in settings.py HOT 3
- ResizeUploadedImage possible server and client-side Resource Exhaustion Vulnerability HOT 1
- Upload files with arbitrary extensions to publicly accessible URL HOT 1
- Enumeration of user ids in API endpoint BadgeUserEmailDetail HOT 2
- Timing-side channel in API helps testing if an email address is registered
- Admin can delete protected items on the admin UI HOT 1
- JWT signed badges signatures can be forged HOT 7
- Unhandled Division by Zero HOT 1
- untrusted XML parsed with xml.dom.minidom.parseString HOT 1
- Badge Check can be fooled by forged badges using unicode domain names HOT 1
- Arbitrary file upload with arbitrary file-extensions in images of badges. HOT 1
- Pathway*list can be created by anyone with a registered email HOT 1
- XSS code injection via Composition Collection share_url HOT 2
- Enumeration of registered email addresses via user profile API HOT 2
- Development and deprecated modules unconditionally enabled HOT 1
- The Add Url Option of the Assign Badge functionality Allows All Urls HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from audit.