HexBrain

Chaturbate · Report #416906

Missing Rate Limitation at /apps/upload_app/

Validstatus
lowseverity
21upvotes
7 Oct 2018disclosed

How it was found

Summary##

I discovered that one is able to create unlimited number of apps via /apps/upload_app/ .

PS: I feel this is within the scope of your program and you want to know about it. If otherwise, I'll be happy to close this.

Steps To Reproduce:

  1. Login and go to https://chaturbate.com/apps/upload_app/
  2. Fill the form
  3. Enable a proxy interception tool (e.g Burp Suite)
  4. Click Save
  5. Send the POST request made to /apps/upload_app/ to intruder
  6. Set 100 or more custom inputs and Start attack
  7. I was able to create many apps without limitation and I've had to pause because of your policy on rate limits

Supporting Material/References:

{F353746}

Impact

Create unlimited apps

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original