Denial of service vulnerabilities are usually excluded from most Bug Bounty programs, but what many people do not know is that this exclusion refers to attacks that flood the server with multiple requests, not to what I am going to tell you about today.
In this article I will show you the vulnerability that was accepted in a YesWeHack program. It was found in a well-known online store but, for now, I prefer not to give more details since it has not been fixed yet.
While browsing the application and capturing all requests with Burp Suite, I found one that sent several product identifiers to check their stock. The response contained 630,974 bytes (about 6 MB) and took 204 milliseconds to respond.
Then it occurred to me to repeat the same identifier many times in order to overload the servers and make the application fail or take longer than expected. After repeating identifier 303 numerous times, the response grew to 70 MB and took almost 7 seconds to arrive.
The endpoints and identifiers have been modified and are not the real ones. In addition, information such as the domain and the rest of the headers has been redacted.
You are probably wondering why I do not send more identifiers. In the example there are 221 IDs, but what would happen if I had sent 300 or 400? In some cases the application returned a 504 Gateway Timeout error.
The real impact of this vulnerability would occur if an attacker sends several simultaneous requests with a large number of IDs, which could take the website down and directly affect its availability.