Description

There was no restriction on the amount of text that can be inserted into a user’s name field. When the text size was large enough the service resulted in a momentary outage in our non-production environment (not high availability). An internal reproduction showed isolated disruption but no outage in our production environment.

Proof of Concept

1. Login account.
2. Visit the profile section.
3. Edit profile & add unlimited random input into the Name field. like [//%3C%3E//http://www.evil.com/projectX.htm] * 10000
4. Save and you can see the disruption in the PoC video.

PoC

https://drive.google.com/file/d/18DYqGoDOdse6yLPjDb-GoqVSaFgAZkVN/view?usp=sharing