RATELIMITED · Report #460642

HTTP PUT method enabled

Spamstatus

criticalseverity

8upvotes

11 Dec 2018disclosed

How it was found

Hi security team,

Summary: It is possible to upload files to the server using the PUT method

Steps To Reproduce: I used the following request: PUT /emitrani.txt HTTP/1.1 Host: ratelimited.me Content-Length: 10 Connection: close

Now a file exists at https://ratelimited.me/emitrani.txt with contents of the put request.

impact

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original