Bypass password reset rate limit protection at moneybird.com/passwords

Summary

Attacker found a way to completely bypass our rate limit protection, allowing for other types of attacks. This involved changing the value of the X-Forwarded-For header. Attacker never got a 429 response from our servers when the value for each request is different.

Injecting X-Forwarded-For : Header with random values leads to bypass rate limit protection 429 on the web application endpoints causing several attacks like brute force , email leakage , dos , email flooding ..etc