0

one of our web page is a contact form eg name, email, and a textbox for sending comments. It seems like if we leave all of those text fields blank and click the submit button, it still went through without giving any errors. Would you consider that a vulnerability, as I think an attack could be automated to submit the form and cause a DOS? in such a case, would implementing re-captcha the best to prevent DOS from happening? what other types of attacks can be used ? I am trying to mitigate as much attack vectors as possible. thanks.

  • why not simply have server-side validation? reject all empty submissions? – schroeder Mar 14 '15 at 4:40
  • thanks schroeder. Will try to implement that, if my programmers have not. I will just flag out as a low risk finding for the time being. – dorothy Mar 14 '15 at 4:44
  • 1
    In addition to schroeder's recommendation, i would suggest having client-side validation too, not to mitigate but to reduce the overhead caused by the server processing each wrong request. – Aatif Shahdad Mar 14 '15 at 20:19
3

No - I would't not consider the ability to submit an empty form as a security vulnerability. I can't think of a reason that the ability to submit an empty form would be more vulnerable than the ability to submit a form with valid or even dummy data.

It is an indication of a poorly written application - and if I came across this I would suspect that there are real vulnerabilities throughout the site, but you can't say for sure without doing an audit.

  • only you would know if it would cause a DoS, depending on how the code is written. Can you explain why you think a Dos could happen? – schroeder Mar 14 '15 at 4:39
  • hi, thanks for reply. But if you can submit an empty form and it doesn't have back end restrictions then could a DOS attack happen? As in, the back end may be "processing" to form, making connections to databases etc... hence too many such kinds of submission without front end validation may cause DOS to happen? – dorothy Mar 14 '15 at 4:40
  • Again - No, I don't think that the ability to submit an empty form makes it any more vulnerable to DOS. If you are doing something really weird on the backend I supposed it's possible. – Abe Miessler Mar 14 '15 at 4:46
  • 1
    @dorothy if you're talking about submissions in general, then blank or full forms would have the same effect. – schroeder Mar 14 '15 at 4:49
  • 1
    @dorothy yes, to protect against auto-submissions, recaptcha is a standard tool to limit the number of submissions, with the standard caveat that there are some software that can auto-solve recaptchas. – schroeder Mar 15 '15 at 2:30
0

No, being able to submit an empty form is not a vulnerability. But if this happens due to the lack of front/back-end validation, then the form is vulnerable to many other forms of attacks such as XSS and injection. An empty submission is not much different to a proper submission when it comes to DOS. In a proper submission, you may have additional processing based on the data entered.

  • I'm not sure how this answer differs from the other answer and comments. – schroeder Mar 23 '15 at 21:26
  • @schroeder Wanted to emphasize the fact that unvalidated inputs are more vulnerable to other types of attacks than DOS. – NilSandaya Mar 23 '15 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.