Unrestricted setPerPage allows huge result sets / resource exhaustion / mass log retrieval

How it was found

Description:

The setPerPage query parameter controls pagination for the log viewer but is not validated or capped on the server. An attacker can supply an extremely large numeric value (for example setPerPage=100000000000000000) and the application will attempt to honor that value when building the result set. This behavior can cause excessive database work, large responses, application slowdowns, and may enable bulk retrieval of log entries.

Steps:

1. Authenticate as a user with access to the log view
2. The setPerPage values ​​range from 10 to 100. Setting the value for setPerPage to 300 results in the site still returning the result:

{F4972841}

{F4972842}

3. This is the typical interface when the value of setPerPage is set within the allowed range

{F4972847}

Impact

• If the server tries to query/render N records extremely large → memory / CPU / DB I/O increases sharply → timeout, OOM, crash (DoS).
• If the backend returns all data in one response → bandwidth/time load is heavy, the browser client may hang.