Stripo Inc · Report #856305
[www.stripo.email] There is no rate limit for contact-us endpoints
Validstatus
lowseverity
47upvotes
26 May 2020disclosed
How it was found
Summary
The speed limit for the https://stripo.email/es/contact-us endpoint has not been implemented.
Steps To Reproduce
- Go to the https://stripo.email/es/contact-us
- Turn on blocking and fill out the contact form
- Send request to Intruder.
- Set your payloads and start attack.
- There is no rate-limit.
Proof of Concept
{F799307}
Fix
Implement 429 status code for too many requests.
Impact
There is no rate limit for submitting an inquiry form.