Race condition on the Federalist API endpoints can lead to the Denial of Service attack
Low
G
GSA Bounty
Submitted None
Actions:
Reported by
sp1d3rs
Vulnerability Details
Technical details and impact analysis
##Description
Hello. I discovered that the Federalist API doesn't have rate limiting in place, and executes any amount of request to the endpoint in parallel mode.
##The impact
Since you are using the cloud, and i can't test the production environment, impact is theoretical in this case - it can be a problem, or it not.
On my localhost instance executing of 1000 parallel GET requests to the http://localhost:1337/v0/me endpoint on behalf of authenticated user was lead to the complete instance inaccessibility. It is a light enough request, and executing of 1000 PUT requests (for example, saving site settings) will have greater impact.
{F202845}
Each request cause execution of the PostgreSQL command, which can lead to the high resource usage.
{F202846}
##Reproduction steps
1) Login to the Federalist instance (unauthenticated requests is possible too, but it have too low impact)
2) Look to the request to the `/v0/me` endpoint. Using Burp Intruder or Charles, repeat the request 1000 times in parallel mode. The server will accept and try to execute all of them in the same time. You can notice increased server resource consumption.
3) You can repeat the test with more heavily site settings saving request.
##Suggested fix
You can consider to implement rate-limiting on the API endpoints (for example, executing not more than 5 API requests in same time from the single user), or implement queue (accept requests from single user in сonsistent mode instead parallel), or use module like https://www.npmjs.com/package/express-rate-limit.
If your production environment somehow mitigates this issue (e.g. has load balancers in place, etc), let me know - i'll close the ticket.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$150.00
Submitted
Weakness
Violation of Secure Design Principles