[intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabled

Disclosed: 2021-01-23 10:13:16 By fuzzme To automattic
High
Vulnerability Details
Hello ## Summary: I have found a no rate limit issue on the report functionality. When you enabled the report functionality on your site, you can set a number of reports before deleting the comment reported. By default, this functionality is unable, but if you enabled this and you set a $x number of reports before deleting the comment, an attacker can spamming this functionality and delete your comment. ## Steps To Reproduce: 1) Login at `https://intensedebate.com` 2) Create your own site at `https://intensedebate.com/install`, and follow the instructions (use generic install) 3) After setup your site, go to `https://www.intensedebate.com/user-dashboard`, on click to `Moderate`. {F1106120} 4) Go to the comment setting by clicking to `Comments` {F1106122} 5) Setup the Report functionality by checked the `Enable "Report this comment" button` and set a number of reports before deleting the comment to `10` and save it {F1106130} 6) Go to your site and add a comment 7) With a other account go to your site, and report the comment manually x10 8) After spam the Report functionality 9) Refresh the page, and you will see the comment is deleted ## POC The video POC `NoRateLimit.mp4` Thank you, Fuzzme. ## Impact Delete any comment in any site when the report functionality is enabled
Actions
View on HackerOne
Report Stats
  • Report ID: 1051734
  • State: Closed
  • Substate: resolved
  • Upvotes: 46
Share this report