HexBrain

Stripo Inc · Report #856305

[www.stripo.email] There is no rate limit for contact-us endpoints

Validstatus
lowseverity
47upvotes
26 May 2020disclosed

How it was found

Summary

The speed limit for the https://stripo.email/es/contact-us endpoint has not been implemented.

Steps To Reproduce

  1. Go to the https://stripo.email/es/contact-us
  2. Turn on blocking and fill out the contact form
  3. Send request to Intruder.
  4. Set your payloads and start attack.
  5. There is no rate-limit.

Proof of Concept

{F799307}

Fix

Implement 429 status code for too many requests.

Impact

There is no rate limit for submitting an inquiry form.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original