HexBrain

Gratipay · Report #117739

limit number of images in statement

Validstatus
mediumseverity
$1bounty
2upvotes
16 Jun 2017disclosed

How it was found

Hello

The use of the images in the statements

![](http://blackdoorsec.net:80/1 "HTTP")

There appears to be no limit on how many can be inserted. On my own account "https://gratipay.com/~34534534fsfs/" I placed 100

Gratipay users could unknowingly become part of a DDoS attack against another site.

I would recommend limiting the number of images that can be placed.

Attached is a video of just a traffic counter being triggered by the page load.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original