Loading HuntDB...

connect.8x8.com: Too much resource consumption of the server due to incorrect date range control via /api/v1/reports?dateFrom=

Low
8
8x8 Bounty
Submitted None
Reported by exhandler

Vulnerability Details

Technical details and impact analysis

Violation of Secure Design Principles
## Summary: Hi Team, When we enter the date range in the reporting endpoint, we see this in the response. When we increase the date range, the byte returned by the server increases. By repeating this over and over, we can cause the server to consume too many resources. As a result, the server may crash. ## Steps To Reproduce: [add details for how we can reproduce the issue] 1. First we must be logged in and go to https://connect.8x8.com/messaging/reports 2. We can see this request when we look at burp requests https://connect.8x8.com/api/v1/reports?dateFrom=2023-02-10&dateTo=2023-02-17&tzName=Europe%2FIstanbul&tz=(UTC%2B03%3A00)&tzOffset=180&timeInterval=1440 3. the server will respond late as you increase the date range and the response size will increase a lot {F2178902} {F2178901} ## Remediation Date range control can be added. ## Impact Potential Dos...

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Violation of Secure Design Principles