Chaturbate · Report #416906
Missing Rate Limitation at /apps/upload_app/
Validstatus
lowseverity
21upvotes
7 Oct 2018disclosed
How it was found
Summary##
I discovered that one is able to create unlimited number of apps via /apps/upload_app/ .
PS: I feel this is within the scope of your program and you want to know about it. If otherwise, I'll be happy to close this.
Steps To Reproduce:
- Login and go to https://chaturbate.com/apps/upload_app/
- Fill the form
- Enable a proxy interception tool (e.g Burp Suite)
- Click Save
- Send the
POSTrequest made to/apps/upload_app/to intruder - Set 100 or more custom inputs and Start attack
- I was able to create many apps without limitation and I've had to pause because of your policy on rate limits
Supporting Material/References:
{F353746}
Impact
Create unlimited apps