[www.drive2.ru] There is no rate limit for comments endpoints.

Summary

The "add comment" endpoint was improperly rate-limited so the potential attacker could post a large number of comments, overloading the server and the notification system.

Summary

The add comment endpoint was improperly rate-limited so the potential attacker could post a large number of comments, overloading the server and the notification system.

Description

The add comment endpoint has a speed limit, but the number is set too high, so speed limiting is activated when you write more than 1000 comments per minute.

Environment

• Browser : Chrome Version 84.0.4147.30
• Scope: Web Application
• Attack type: OWASP API TOP10 Lack of Resources & Rate Limiting
• Maximum user privileges needed to reproduce your issue: no privileges

Fix

Developers alleviated the problem by setting the speed limit to low for endpoints that set the speed too high.