✍️ Description

This endpoint handler performs a file system operation and does not use a rate-limiting mechanism.

🕵️‍♂️ Proof of Concept

{
   fs.writeFileSync(runtime.settings.userSettingsFile, JSON.stringify(req.body, null, 4));
  mergeUserSettings(req.body);
  res.end();
  }

FIx

Consider using a rate-limiting middleware such as express-limit.

"express-rate-limit": "^5.0.0",
];
var start = true;
const app = express();
var RateLimit = require('express-rate-limit');
var limiter = new RateLimit({
    windowMs: 60*1000, // 1 minute
    max: 5
});

💥 Impact

It may enable the attackers to perform Denial-of-service attacks.