Abuse of Api that causes spamming users and possible DOS due to missing rate limit
Low
W
Weblate
Submitted None
Actions:
Reported by
khalidamin
Vulnerability Details
Technical details and impact analysis
##Summary:
In your sub-domain: http://demo.weblate.org , another endpoint doesn't have any rate limit on it to prevent spamming you by posting a lot of questions.
##Description:
Spamming and Possible DOS is being possible due to missing rate limit on this endpoint.
**Request**
POST /accounts/email/ HTTP/1.1
Host: demo.weblate.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://demo.weblate.org/
Cookie: XXX
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 126
csrfmiddlewaretoken=&email=victim_email&content=
Report Details
Additional information and metadata
State
Closed
Substate
Resolved