HexBrain

Chaturbate · Report #418145

No rate limiting in changing room subject.

Validstatus
lowseverity
19upvotes
9 Oct 2018disclosed

How it was found

Before i shed more light on this: I noticed i can create over 200 apps but i don't really know how valid that was. I want to report that there is no rate limiting in changing room subject. Attacker scenrio:

  1. Navigate to https://chaturbate.com/b/your username
  2. Try to create a room subject and capture the request.
  3. Send to intruder and repeater it numerous times.
  4. I tried this 144 times and it was succesful Thanks Below is a video as a poc

Impact

bruteforcing.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original