2

I'm testing a web app and noticed that by converting a particular GET request to a POST request the server takes about 30 seconds to respond and then returns a generic error page (compared to the original GET request which took the server about 300ms to respond).

What are the chances that this could be used for a DoS attack and how serious would that be?

I'm asking because I'm hesitating to submit this bug to the app owner who is running a bug bounty program as I do want to avoid negative feedback/reputation.

5

What are the chances that this could be used for a DoS attack and how serious would that be?

The chances are good. If a specially crafted request causes an unusually long waiting time that's a good indicator that you're occupying a thread on the server and found a potential Denial of Service attack vector. DoS bugs often get overlooked in web applications but there are quite a few ways in which they can occur (SQL wildcard attacks, pending network requests, etc.). Against many web frameworks there have been published advisories on DoS flaws, like this one for Wordpress.

The severity obviously depends on the service they're running. A small web shop could lose a few potential customers - on the other hand, for a bitcoin trading site it could result in great money loss.

I'm asking because I'm hesitating to submit this bug to the app owner who is running a bug bounty program as I do want to avoid negative feedback/reputation.

Bug Bounty Programs often explicitly exclude DoS vulnerabilities from their scope. But that doesn't mean they're not interested - rather, vendors are often afraid to encourage attacks which would likely impact their services (which a DoS clearly does).

I would still report it. BBPs have rewarded DoS flaws in the past, for example here or here. I'd clarify that you have not actively been looking for DoS bugs but found behavior that strongly indicates that a DoS attack vector might be there. I'm sure they're interested to have a look at this if they recognize you as a responsible researcher.

There is also this OWASP guide on testing for DoS vulnerabilities, but as said, I wouldn't actively do it without permission. That wouldn't be the first time someone got banned from a BBP.

  • 1
    Great answer! A minor detail: Not all servers use one thread per request. If the server is running e.g. Node that is not the case. – Anders Dec 4 '16 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.