Lack of Resources and Rate Limiting
Play Labs on this vulnerability with SecureFlag!
Description
Whilst the internet may often seem as though it were boundless, it is still bound by a finite amount of computing resources and subject to limitations, with only so much bandwidth, CPU processing power, memory allocation, and storage to go around. At the individual level, for example, think of the last time you tried to spin up that third virtual machine while the host browser was feverishly feeding your multiple open tab habit… resource limitations in action! And although this illustration depicts a non-malicious - indeed, self-imposed - consequence of overload for an individual laptop, there are, unfortunately, attacks that leverage resource and rate limitations of web applications and APIs that have not been configured correctly.
Application requests are pretty much what make the internet the internet, with some estimates suggesting that API requests alone make up over 83% of all web traffic. Applications perform day-to-day functions adequately when the request parameters governing the numbers of processes, size of payloads, etc., are set at the appropriate minimums and maximums. However, when the aforementioned resources are incorrectly assigned, applications are not only subject to poor or non-existent performance, but they can also be commandeered by malicious actors to disrupt and deny service.
According to OWASP’s API4:2023 Unrestricted Resource Consumption, APIs, for example, are vulnerable if even just one of the below limits is lacking or incorrectly set:
- Execution timeouts: the API gateway will wait a certain number of seconds for the endpoint to return a response… this value can be anywhere from 1 second to many years’ worth of seconds, so it is important to define correctly.
- Max allocable memory: the maximum amount of memory allocated to the API.
- Number of file descriptors: the more files opened for your process, the more labor-intensive.
- Number of processes: the more processes, the more labor-intensive.
- Request payload size (e.g., uploads): the larger the upload, the greater the consumption.
- Number of requests per client/resource: this could be 100 requests per 100 seconds per user but also 1000 requests per 100 seconds per user - 10X the load.
- Number of records per page to return in a single request-response: stuffing more records into a single response will naturally degrade performance.
Bottom line: set one of the above too low or too high, and your application is at risk.
Impact
Whatever the type of application, inadequately configured resource allocation, and rate limits are routinely targeted by attackers. Attacks such as these undermine reliability and availability of entire ecosystems, inevitably resulting in financial and reputational loss.
Scenarios
Suppose an API is tasked with the retrieval of user-profiles and their corresponding details, providing, as most APIs do, access to its resources that take the form of lists of entities. A set limit of returnable items would typically confine a client filtering this list.
www.vulnerableapp.com/api/v1/get_user_list?page=1&size=9000000
An astute observer will have noticed that the request here would return page 1 and the first 9000000 users, which certainly seems like an above-average number of users for just one page! This attack would succeed to overwhelm the API if the size parameter was improperly validated.
Prevention
Attacks targeting application misconfigurations that allow unbridled resources and limits are common - the exploitation is uncomplicated and requires minimal resources to execute. Fortunately, robust defense is reasonably straightforward to implement so long as attention is paid to limits that dictate finite resources, i.e., the abovementioned CPU processing power, memory allocation, number of processes and file descriptors, etc.
Prevention strategies include:
- Limiting the number of times a client can call an application within a given timeframe.
- Setting limit numbers and reset times and communicating them with the client.
- Ensuring query strings and request body parameters are properly validated by the server.
- Place a limit on the data size of incoming parameters and payloads.
- For any application, adhere to best practices laid out in the configuration guidelines. For example, APIs moored in the overwhelmingly popular Docker need only review and adequately implement appropriate configurations for memory resources, CPU, restart policies, and container ulimits (limits for file descriptors and processes).
Testing
Verify that anti-automation controls are effective at mitigating breached credential testing, brute force, and account lockout attacks. Such controls include blocking the most common breached passwords, soft lockouts, rate limiting, CAPTCHA, ever-increasing delays between attempts, IP address restrictions, or risk-based restrictions such as location, first login on a device, recent attempts to unlock the account, or similar.
- OWASP ASVS: 2.2.1
- OWASP Testing Guide: Testing for Weak Lock Out Mechanism