DDOS on GET:/api/v1/savings-transaction #101
Description
Title: DDOS Vulnerability on GET:/api/v1/savings-transaction
Project: SanityGitHub0306
Description: The Application DDoS exploit allows an attacker to overwelm you Application/DB by requesting seemingly large resources through vulnerable endpoint.
Risk: DDOS
Severity: Major
API Endpoint: http://138.91.64.62:8080/api/v1/savings-transaction?pageSize=1001
Environment: Master
Playbook: ApiV1SavingsTransactionGetQueryParamPagesizeDdos
Researcher: [apisec Bot]
QUICK TIPS
Suggestion: Add a max limit validation on the endpoint params used for requesting maximum number of resources.
Effort Estimate: 0.5
Wire Logs:
08:52:00 [D] [AVSTGQPPDdos] : URL [http://138.91.64.62:8080/api/v1/savings-transaction?pageSize=1001]
08:52:00 [D] [AVSTGQPPDdos] : Method [GET]
08:52:00 [D] [AVSTGQPPDdos] : Auth [default]
08:52:00 [D] [AVSTGQPPDdos] : Request []
08:52:00 [D] [AVSTGQPPDdos] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[**********]}]
08:52:00 [D] [AVSTGQPPDdos] : Response [{
"requestId" : "None",
"requestTime" : "2020-06-03T08:52:00.820+0000",
"errors" : false,
"messages" : [ ],
"data" : [ ],
"totalPages" : 0,
"totalElements" : 0
}]
08:52:00 [D] [AVSTGQPPDdos] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTM1ODQ3MDMtOGIxYS00NjFiLWI5ZWQtM2M1MjQwMjc2Yjc4; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 03 Jun 2020 08:52:00 GMT]}]
08:52:00 [D] [AVSTGQPPDdos] : StatusCode [200]
08:52:00 [D] [AVSTGQPPDdos] : Time [546]
08:52:00 [D] [AVSTGQPPDdos] : Size [137]
08:52:00 [I] [AVSTGQPPDdos] : Assertion [@statuscode != 404] resolved-to [200 != 404] result [Passed]
08:52:00 [I] [AVSTGQPPDdos] : Assertion [@statuscode != 401] resolved-to [200 != 401] result [Passed]
08:52:00 [E] [AVSTGQPPDdos] : Assertion [@statuscode != 200] resolved-to [200 != 200] result [Failed]
IMPORTANT LINKS
Vulnerability Details:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba01727922a45a0593/recommendations/8a8081397278f8ba0172796194c6258d/details
Project:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba01727922a45a0593/jobs
Coverage:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba01727922a45a0593/configuration
PS: Please contact support@apisec.ai for apisec access and login issues.
--- apisec Bot ---