No Rate Limiting on Forgot Password
Introduction to No Rate Limit ?
A "no rate limiting" vulnerability refers to a security weakness in a system or application where rate limiting controls are not properly implemented or absent altogether. Rate limiting is a technique used to restrict the number of requests or actions that can be performed within a given timeframe. It is commonly employed to protect against various types of attacks, such as brute force attacks, denial-of-service (DoS) attacks, and other forms of abuse.
Without rate limiting, attackers have the freedom to perform actions at an unlimited rate, which can lead to severe consequences for the targeted system or application. The lack of restrictions on request rates allows malicious actors to bypass authentication mechanisms, guess passwords, or exhaust server resources, ultimately compromising the security and availability of the system.
When a system lacks proper rate limiting mechanisms, it becomes vulnerable to exploitation. Attackers can potentially launch attacks that exploit this vulnerability by overwhelming the system with a high volume of requests, causing performance degradation, service disruption, or even a complete system failure. This can result in unauthorized access, data breaches, or other security breaches.
In This Article ?
- Introductions to No Rate Limit
- How to Test No Rate Limit
- Impact & Mitigation
- How to Report ?
Finding Vulnerability Steps ?
STEP #1: Go to any site, create an account and logout, then take the traffic of forget password on burp suite.
Mitigation :
Implementing rate limiting can be achieved through various techniques, i.g:
1. Request throttling: Limiting the number of requests from a particular IP address, user account, or API key within a given time period.
2. Captchas and challenge-response mechanisms: Introducing additional steps, such as solving a captcha or providing additional authentication, to differentiate between legitimate users and automated malicious activities.
3. Concurrent connection limiting: Restricting the number of simultaneous connections from a single client or IP address.
4. Adaptive rate limiting: Adjusting the rate limits dynamically based on the observed traffic patterns, allowing for flexibility while preventing abuse.
Impact:
Without rate limiting, attackers can launch brute-force attacks against user accounts. They can systematically try different passwords or password combinations at a rapid pace without any restrictions. This increases the chances of successfully guessing a user's password, leading to unauthorized access.
With unlimited attempts, attackers can automate the process of trying different passwords for multiple user accounts. If successful, they can gain unauthorized access to user accounts, enabling them to exploit personal information, perform malicious actions, or impersonate legitimate users.
Credential stuffing is an attack technique where attackers use lists of previously compromised usernames and passwords to gain unauthorized access to other online accounts. A no rate limiting vulnerability on the "forgot password" feature can make it easier for attackers to automate the process of testing these compromised credentials against user accounts.
How to Report ?
Hello Team
I'm Career Technology Cyber security India a white security researcher from Mumbai INDIA, founded Vulnerability on your website :- https://exmple.com/en/
Vulnerability Name : No Rate Limit On Reset Password
Summary:
A rate limiting algorithm is used to check if the user session (or IP address) has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP servers can respond with status code 429 : Too Many Requests.(wikipedia)
I just realized that on the reset password page, the request has no rate limit which then can be used to loop through one request.
Steps To Reproduce:
1.Go to https://exmple.com/en/passwordrecovery , enter the email then click reset password
2.Intercept this request in burp suite
POST /en/passwordrecovery HTTP/1.1
Host: exmple.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0§§
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://exmple.com/en/passwordrecovery
Content-Type: application/x-www-form-urlencoded
Content-Length: 235
Origin: https://exmple.com
Connection: close
Cookie: wisepops_activity_session=%7B%22id%22%3A%2217efcadd-42d1-4e1a-afe5-0ac900d69bf7%22%2C%22start%22%3A1670153925010%7D; _tq_id.TV-09095409-1.3e50=4822d03dff83b94c.1667799352.0.1670154412..; _gcl_au=1.1.605565146.1667799352; _ga=GA1.2.963703441.1667799352; wisepops=%7B%22csd%22%3A1%2C%22popups%22%3A%7B%7D%2C%22sub%22%3A0%2C%22ucrn%22%3A31%2C%22cid%22%3A%2236629%22%2C%22v%22%3A4%2C%22bandit%22%3A%7B%22recos%22%3A%7B%7D%7D%7D; wisepops_visits=%5B%222022-12-04T11%3A38%3A44.234Z%22%2C%222022-12-04T06%3A46%3A57.957Z%22%2C%222022-11-19T08%3A56%3A31.711Z%22%2C%222022-11-19T08%3A51%3A16.049Z%22%2C%222022-11-12T08%3A41%3A32.010Z%22%2C%222022-11-12T08%3A29%3A59.207Z%22%2C%222022-11-12T08%3A10%3A10.157Z%22%2C%222022-11-12T08%3A10%3A04.881Z%22%2C%222022-11-12T06%3A44%3A52.371Z%22%2C%222022-11-12T04%3A53%3A34.891Z%22%5D; calltrk_referrer=https%3A//www.google.com/; calltrk_landing=https%3A//exmple.com/en/kayden-3-piece-table-set%3Futm_source%3Dhzsocial%26utm_medium%3Dfacebook%26utm_campaign%3Dmaysale; __attentive_id=3ae215a454814101b30a8069ae34b601; __attentive_cco=1667799353039; _attn_=eyJ1Ijoie1wiY29cIjoxNjY3Nzk3MTQyNjI0LFwidW9cIjoxNjY3Nzk3MTQyNjI0LFwibWFcIjoyMTkwMCxcImluXCI6ZmFsc2UsXCJ2YWxcIjpcIjNhZTIxNWE0NTQ4MTQxMDFiMzBhODA2OWFlMzRiNjAxXCJ9In0=; _hjSessionUser_153966=eyJpZCI6ImIyMmNlYTI4LTllOWMtNTMyOS1iNzBhLWVlMGQ4N2M3MjYyMiIsImNyZWF0ZWQiOjE2Njc3OTcxNDM4MTcsImV4aXN0aW5nIjp0cnVlfQ==; _fbp=fb.1.1667799352239.342880729; _gid=GA1.2.192812431.1670136420; _tt_enable_cookie=1; _ttp=dyIA5EyGTCMNq-k_pdbcrPPnq3n; __attentive_dv=1; ARRAffinity=de7d6685337db5796ac937cb299869659d92886509fa86a84877d6b74ca14565; ARRAffinitySameSite=de7d6685337db5796ac937cb299869659d92886509fa86a84877d6b74ca14565; .Nop.Antiforgery=CfDJ8BcgCOzQSstMhG1N3kEu15Zc3LPMN-jKKppbwsAPpXuyYEtgtjfNF7u3B_IPVpFnwI0JPHXPZpuDt56OFV_QviGAtisSBcis_gGZuvkCGmPv6CAB6_pNRiKhkWhn1GtGWTv8m_DqJW4TtgNQzXiN14k; wisepops_session=%7B%22arrivalOnSite%22%3A%222022-12-04T11%3A38%3A44.234Z%22%2C%22mtime%22%3A1670154412661%2C%22pageviews%22%3A18%2C%22popups%22%3A%7B%7D%2C%22bars%22%3A%7B%7D%2C%22countdowns%22%3A%7B%7D%2C%22src%22%3Anull%2C%22utm%22%3A%7B%7D%2C%22testIp%22%3Anull%7D; _hjIncludedInSessionSample=0; _hjSession_153966=eyJpZCI6ImEyMjQzOTFlLTc5NmEtNDY2NS1hOWU3LTYzZGVmODQ3OWI3MSIsImNyZWF0ZWQiOjE2NzAxNTM5MjY1MTQsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=0; __attentive_pv=17; __attentive_ss_referrer="ORGANIC"; attntv_mstore_email=princepalbughr20@gmail.com:0; .Nop.Culture=c%3Den-US%7Cuic%3Den-US; _gat_gtag_UA_6928121_1=1; .Nop.Customer=818f18dd-3fcc-4f0b-bdda-2e9cbfbcceb7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Email=pricepalbghunter20%40gmail.com&send-email=&__RequestVerificationToken=CfDJ8BcgCOzQSstMhG1N3kEu15a3l5f2vSBwHdLJhrU0TEzKJqOmM82BCQLx1cfQQ6xy4FmOY5LrJ-diylZ7chC2pZhOCd0xqG05UM19ydbMm5767vb9zdDqS6tT9VCQNQziyFoQ_I13-XfMLO0c4490HVs
3. Send it to the intruder and repeat .
4. Start attack and some time wait
5. You will get 200 OK status and go to your email and see you will receive multiple mails.
6. I already attached the PoC video too if you don't understand my explanation
POC,link:- https://drive.google.com/file/d/1NY9BC_oeHezh8ekrtgr4ANwhVylJCdAt/view?usp=sharing
Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]
https://hackerone.com/reports/751604
https://hackerone.com/reports/441161
https://hackerone.com/reports/280534
Suggested fix
Use CAPTCHA verification if many requests are sent.
Impact
Trouble to the users on the website because huge email bombing can be done by the attackers within seconds.
Thanks & Regard,
Career Technology Cyber security India
Indian Bug Hunter
Comments
Post a Comment