The publify application allows large characters to insert in the input field "First name and Last name" on the profile field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in publify / publify in publify/publify
Reported on
May 15th 2022
Description
The publify application allows large characters to insert in the input field "First name and Last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request
Proof of Concept
1 - go to your profile https://demo-publify.herokuapp.com/admin/profiles
2 - Fill the first name & last name field with huge characters, (more than 1 lakh) Copy the below payload and put it in the input fields and click on Save.
Payload - https://drive.google.com/file/d/1E3iqSQE4-t4dXpWQrDPHY7OcspHxYvYE/view
3 -You will see the application accepts large characters and if we will increase the characters then it can lead to Dos.
POC VIdeo :- https://drive.google.com/file/d/14-yHlzy8_y_ENkDAqJouLlEYNn2NLd7q/view?usp=sharing
POC Screenshot :- https://drive.google.com/file/d/12IAqG1OQeyp2_qA53t-LyoccgCuNoDO3/view?usp=sharing
Impact
This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
Patch recemmondation:
The first name & last name input should be limited to 50 characters or max 100 characters.
You have to limit The first name & last name input should be limited to 50 characters or max 100 characters.
I'm checking the Vulnerability Type for this vulnerability, and it seems incorrect. Perhaps CWE-20: Improper Input Validation is more appropriate?