Lucene search

K
huntrAkshayravic09yc473FDA8902-68EE-4734-86A3-9551AB17C893
HistoryMay 20, 2022 - 6:32 a.m.

Allocation of Resources Without Limits in

2022-05-2006:32:50
akshayravic09yc47
www.huntr.dev
22
admin
conversation
huge characters
dashboard
dos
server
patch
bug bounty

EPSS

0.001

Percentile

31.9%

Steps to reproduce:

  1. As an admin, start a new conversation with any member(normal user)
  2. If the member(normal user) reply with a text of huge characters, (more than crores, etc)the admin may not able to access the dash board and its get started lagging, because the server get DOS

POC Screenshot:

[IMAGE ALT TEXT HERE

POC Video:

https://www.mediafire.com/file/tzfqws14imvdfxr/trudesk_dos.mov/file

Patch recommendation:

  1. Limit the characters to max (5000 or 10000)

EPSS

0.001

Percentile

31.9%

Related for 3FDA8902-68EE-4734-86A3-9551AB17C893