Send email asynchronously
Medium
G
Gratipay
Submitted None
Actions:
Reported by
hharry
Vulnerability Details
Technical details and impact analysis
It seems like the https://gratipay.com/~USER/emails/modify.json endpoint has some protection to prevent email flooding as seen here https://github.com/gratipay/gratipay.com/blob/master/gratipay/models/participant.py#L407 plus CSRF validation.
However, it is possible to flood the server with multiple email requests as long as you send different email addresses. This might be a door to a DoS attack considering emails are sent synchronous on the request (this means each email sending request will hold that thread and connection for quite a good time). Finally, depending on what email server you are using, if this can be abused you might end up paying for a lot of sent emails.
Note that I'm not 100% sure there's no other kind of throttling on this endpoint and I was too afraid to test.
Below is the screenshot of a few sent emails showing how all of them were sent correctly and high time it took on the server and another one of me receiving all of them.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$10.00
Submitted
Weakness
Uncontrolled Resource Consumption