Subject: New Reply Received - No Rate Limit Vulnerability On babyshopstores.com
From: Babyshop <[email-masked]>
To: [email-masked]
Date: Fri, 09 Oct 2020 16:09:22 +0000

Hi Seeta Kunwar,  The customer has responded to the ticket.  No Rate Limit Vulnerability On babyshopstores.com  Ticket comment <div dir="auto">Still it's not resolved...</div>
<br><div class="gmail_quote"><div dir="ltr" class="gmail_attr"></div></div>
<div class="freshdesk_quote"><blockquote class="freshdesk_quote">
<div>On Tue, 6 Oct 2020, 19:25 Shubham, &lt;<a href="mailto:[email-masked]" rel="noreferrer">[email-masked]</a>&gt; wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'>
<span style="line-height:106%">Vulnerability
Name : </span>No Rate Limit On Forgot Password Page <span style="line-height:106%"><span></span></span>
</div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%"> <span></span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%">Introduction
:<span></span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'>A little bit about Rate Limit:<br>
A rate limiting algorithm is used to check if the user session (or IP-address)
has to be limited based on the information in the session cache.<br>
In case a client made too many requests within a given timeframe, HTTP-Servers
can respond with status code 429: Too Many Requests.<span style="line-height:106%"><span></span></span>
</div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%"> <span></span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%">Description
:<span></span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'>I have identified that when
Forgetting Password for account , the request has no rate limit which then can
be used to loop through one request. Which can be annoying to the root users
sending mass password to one email.<span style="line-height:106%"><span></span></span>
</div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%"><span> </span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%">Domain
Name : <a href="https://www.babyshopstores.com/ae/en/" style="color:blue;text-decoration:underline" target="_blank" rel="noreferrer">https://www.babyshopstores.com/ae/en/</a><span></span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%"><span> </span></span></div>

<h4 style='margin-right:0cm;margin-left:0cm;font-size:12pt;font-family:"Mangal",serif;font-weight:bold'>
<span style='font-family:"Calibri",sans-serif'>Vulnerable
URL : (</span><span style='font-size:11pt;font-family:"Calibri",sans-serif;font-weight:normal'>Forgot your password</span><span style='font-family:"Calibri",sans-serif'> </span><span style='font-family:"Calibri",sans-serif;font-weight:normal'>page</span><span style='font-family:"Calibri",sans-serif'>)
<a href="https://www.babyshopstores.com/ae/en/" style="color:blue;text-decoration:underline" target="_blank" rel="noreferrer">https://www.babyshopstores.com/ae/en/</a></span><span></span>
</h4>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%"><span> </span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%">Steps
To Reproduce this Vulnerability :<span></span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'>Step 1 - Go To <b><span style="line-height:106%">Forgot your password</span></b><span style="line-height:106%"> <b>page</b></span><span style="line-height:106%"><span></span></span>
</div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'>
<span style="line-height:106%">   
</span><span>           </span>Enter Email Click On Submit.<span></span>
</div>

<h2 style='margin:2pt 0cm 0cm;line-height:107%;break-after:avoid;font-size:13pt;font-family:"Calibri Light",sans-serif;color:rgb(47,84,150);font-weight:normal'>
<span style='font-size:11pt;line-height:107%;font-family:"Calibri",sans-serif;color:windowtext'>Step
2 - I</span><span style='font-size:11pt;line-height:107%;font-family:"Calibri",sans-serif;color:windowtext'>ntercept This
Request In Burp And Forward Till You Found Your Number In Request<span></span></span>
</h2>

<div class="MsoNormal" style='margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:"Calibri",sans-serif'><span> </span></div>

<div class="MsoNormal" style='margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:"Calibri",sans-serif'>Step 3- Now Send This Request To Intruder And Repeat It 100
Time By Fixing Any Arbitrary Payload Which Doesn't No Effect Request I Choose
Accept-Language: en-US,en;q=0.$5$<span></span>
</div>

<div class="MsoNormal" style='margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:"Calibri",sans-serif'>Step 4 - See You Will Get 200 ok Status Code &amp; 100 +
Email In Your INBOX<br>
See It Is Resulting In Mass Mailing Or Email Bombing To Your Users Which Is Bad
For Business Impact<span></span>
</div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%"><span> </span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%"> <span></span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%">Demonstration
of the vulnerability :<span></span></span></div>

<div class="MsoNormal" style='line-height:106%;margin:0cm 0cm 8pt;font-size:11pt;font-family:"Calibri",sans-serif'><span style="line-height:106%">Tested
on Firefox and chrome.<span></span></span></div>

<h2 style='margin:2pt 0cm 0cm;line-height:107%;break-after:avoid;font-size:13pt;font-family:"Calibri Light",sans-serif;color:rgb(47,84,150);font-weight:normal'><b>Impact<span></span></b></h2>

<div style='margin-right:0cm;margin-left:0cm;font-size:10pt;font-family:"Mangal",serif'>If You Are Using Any Email Service Software API Or Some Tool Which Costs You
For Your Email This Type Of Attack Can Result You In Financial Lose And It Can
Also Slow Down Your Services It Can Take Bulk Of Storage In Sent Mail Although
If Users Are Affected By This Vulnerability They Can Stop Using Your Services
Which Can Lead To Business Risk<span></span>
</div>

<h2 style='margin:2pt 0cm 0cm;line-height:107%;break-after:avoid;font-size:13pt;font-family:"Calibri Light",sans-serif;color:rgb(47,84,150);font-weight:normal'>POC- Find Video Attached Below<span></span>
</h2>

<div class="MsoNormal" style='margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:"Calibri",sans-serif'>
<b><span style="line-height:107%">1 attachment: Video
attached on mail</span></b><span></span>
</div>

</div>
</blockquote>
</blockquote></div>  https://landmarkgroupservice.freshdesk.com/helpdesk/tickets/1559132