HexBrain

Automattic · Report #488923

No Rate Limit on CrowdSignal Polls when Adding Comment

Validstatus
lowseverity
16upvotes
13 Apr 2019disclosed

How it was found

Hi team!

I hope this isn't duplicate :/

I created a poll on CrowdSignal.com (https://poll.fm/10226924) When adding a comment, there is no rate limit. You can see my comments on my poll.

  1. Go to any poll.
  2. Turn on Intercept and Add a Comment.
  3. Send request to Intruder.
  4. Set your payloads and start attack.

There is no rate-limit.

Impact

No rate-limit on comments.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original