#### Project Information * Repository: https://github.com/stoodkev/steemplus-api * Project Name: **SteemPlus (API)** * Publisher (if applicable): @stoodkev #### Expected behavior The job that updates the SPP (Steemplus Points) should only run every hour, as mentioned in the coding. [](https://cdn.steemitimages.com/DQmZ37YBrh2qS67WULXkUrQzoReFZsDKsd6pdApyyG82EzR/image.png) Only authorized persons should be able to start resource-intensive jobs on the steemplus api server. Such a functionality is never to be exposed via an api. #### Actual behavior Every user is able to call the mentioned api endpoint to start the job manually. A malicious user could use this to overload the steemplus api server, resulting in a DOS (Denial-of-Service) attack. It is also possible (by creating a few requests in parallel) that some of the points are missing or doubled in the database, depending on the exact moment this is attempted. #### How to reproduce It is easily possible to reproduce the bug by just calling the specific endpoint for the api: **/job/update-steemplus-points** #### Solution A solution could be to secure the api endpoint via a private key saved in the config. With this only authorized users can call the function. Another solution would be to not expose this function to the api at all and only call it internally via a cronjob or similar. I decided to go with solution number one and started a pull-request for it: [Pull-Request](https://github.com/stoodkev/steemplus-api/pull/8) #### Recording Of The Bug Before executing the job: [](https://cdn.steemitimages.com/DQmcCRJsRfG7CdJLAeSSGeNJtuDuqAC2Vs4phAiySxK8a4N/image.png) Executing the job: [](https://cdn.steemitimages.com/DQmU5edoLcfuSun3QYuQ5aCohnB64YRMD89NwBRSmagKGx5/image.png) After executing the job: [](https://cdn.steemitimages.com/DQmbXqpVCukkEUFjU3KQCykt1NVyXrBJVHB7PGBAckEvmTN/image.png) As we see my user-information was created and my points where updated without waiting for an hour. #### GitHub Account https://github.com/MWFIAE The problem was brought to the Project Owner via a [github issue](https://github.com/stoodkev/steemplus-api/issues/9) (additional to the [Pull-Request](https://github.com/stoodkev/steemplus-api/pull/8)) and I also reached out to him via discord where he confirmed that this is a problem. (Screenshot can be provided if needed )
author | mwfiae | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
permlink | bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job | ||||||||||||
category | utopian-io | ||||||||||||
json_metadata | {"tags":["utopian-io","bug-hunting","steemplus","api","dos"],"app":"steemit/0.1","users":["stoodkev"],"image":["https://cdn.steemitimages.com/DQmZ37YBrh2qS67WULXkUrQzoReFZsDKsd6pdApyyG82EzR/image.png","https://cdn.steemitimages.com/DQmcCRJsRfG7CdJLAeSSGeNJtuDuqAC2Vs4phAiySxK8a4N/image.png","https://cdn.steemitimages.com/DQmU5edoLcfuSun3QYuQ5aCohnB64YRMD89NwBRSmagKGx5/image.png","https://cdn.steemitimages.com/DQmbXqpVCukkEUFjU3KQCykt1NVyXrBJVHB7PGBAckEvmTN/image.png"],"links":["https://github.com/stoodkev/steemplus-api","https://cdn.steemitimages.com/DQmZ37YBrh2qS67WULXkUrQzoReFZsDKsd6pdApyyG82EzR/image.png","https://github.com/stoodkev/steemplus-api/pull/8","https://cdn.steemitimages.com/DQmcCRJsRfG7CdJLAeSSGeNJtuDuqAC2Vs4phAiySxK8a4N/image.png","https://cdn.steemitimages.com/DQmU5edoLcfuSun3QYuQ5aCohnB64YRMD89NwBRSmagKGx5/image.png","https://cdn.steemitimages.com/DQmbXqpVCukkEUFjU3KQCykt1NVyXrBJVHB7PGBAckEvmTN/image.png","https://github.com/MWFIAE","https://github.com/stoodkev/steemplus-api/issues/9"],"format":"markdown"} | ||||||||||||
created | 2018-09-04 16:17:39 | ||||||||||||
last_update | 2018-09-04 17:06:36 | ||||||||||||
depth | 0 | ||||||||||||
children | 13 | ||||||||||||
last_payout | 2018-09-11 16:17:39 | ||||||||||||
cashout_time | 1969-12-31 23:59:59 | ||||||||||||
total_payout_value | 27.304 HBD | ||||||||||||
curator_payout_value | 9.027 HBD | ||||||||||||
pending_payout_value | 0.000 HBD | ||||||||||||
promoted | 0.000 HBD | ||||||||||||
body_length | 2,721 | ||||||||||||
author_reputation | 8,649,692,852,318 | ||||||||||||
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" | ||||||||||||
beneficiaries |
| ||||||||||||
max_accepted_payout | 100,000.000 HBD | ||||||||||||
percent_hbd | 10,000 | ||||||||||||
post_id | 70,306,960 | ||||||||||||
net_rshares | 33,217,751,826,930 | ||||||||||||
author_curate_reward | "" |
voter | weight | wgt% | rshares | pct | time |
---|---|---|---|---|---|
steemitboard | 0 | 942,252,782 | 1% | ||
pawos | 0 | 88,300,949,634 | 100% | ||
jeanpi1908 | 0 | 24,130,332,756 | 37% | ||
haiyangdeperci | 0 | 6,921,266,507 | 20% | ||
ennosan | 0 | 13,057,916,495 | 100% | ||
utopian-io | 0 | 32,254,393,122,744 | 21.6% | ||
obvious | 0 | 60,298,645,310 | 100% | ||
bestbroplayer | 0 | 102,132,712,011 | 100% | ||
amosbastian | 0 | 14,390,733,417 | 23.63% | ||
muhammadarif | 0 | 1,063,375,386 | 100% | ||
tonkatonka | 0 | 699,514,204 | 100% | ||
security101 | 0 | 55,392,743,098 | 100% | ||
snackaholic | 0 | 7,417,594,527 | 100% | ||
polbot | 0 | 228,950,161 | 100% | ||
flugschwein | 0 | 28,491,576,840 | 100% | ||
melvin7 | 0 | 25,892,426,942 | 100% | ||
backinblackdevil | 0 | 14,429,207,159 | 61% | ||
simplymike | 0 | 48,965,490,667 | 38% | ||
k3lda | 0 | 21,722,363,781 | 100% | ||
lauchmelder | 0 | 477,777,426 | 100% | ||
mwfiae | 0 | 38,490,924,358 | 100% | ||
rivalzzz | 0 | 49,029,708,447 | 100% | ||
baenkie | 0 | 609,832,925 | 100% | ||
louis88 | 0 | 47,687,170,119 | 100% | ||
statsexpert | 0 | 1,317,689,114 | 20% | ||
qurator-tier-0 | 0 | 3,268,435,588 | 2% | ||
darkassassin | 0 | 2,100,253,805 | 100% | ||
twirllinks | 0 | 0 | 100% | ||
steem-ua | 0 | 296,644,356,529 | 2.05% | ||
nothingismagick | 0 | 3,136,664,321 | 100% | ||
mw-actifit | 0 | 51,590,383 | 100% | ||
power-whale | 0 | 6,066,249,494 | 25% |
Hi @mwfiae, thanks for your report. I worked on that part of Steem-plus and I apparently did a smaaaaall mistake haha. I just want to clarify a point. When you say `It is also possible (by creating a few requests in parallel) that some of the points are missing or doubled in the database, depending on the exact moment this is attempted.`, it is actually not possible to double your points because we only proceed data created after the last entry of our database. We decided to execute the job once every hour at first not to overload our server, but we could have done it every 5 minutes. :)
author | cedricguillas |
---|---|
permlink | re-mwfiae-bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job-20180906t101722493z |
category | utopian-io |
json_metadata | {"tags":["utopian-io"],"users":["mwfiae"],"app":"steemit/0.1"} |
created | 2018-09-06 10:17:21 |
last_update | 2018-09-06 10:17:21 |
depth | 1 |
children | 1 |
last_payout | 2018-09-13 10:17:21 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 0.000 HBD |
curator_payout_value | 0.000 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 596 |
author_reputation | 1,509,744,265,110 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,488,778 |
net_rshares | 0 |
Hi Cedric, Mistakes can happen that's why it's open source, so that mistakes can be spotted easily and fixed before harm is done :) After some consideration I think you are right, it shouldn't be possible to double the points, but it's very easily possible to miss points entirely. But anyhow, that's resolved now by securing the function :) Also can you please contact me on discord? I think I found a few other points that need consideration :) MWFIAE#7029 Greeting, MW
author | mwfiae |
---|---|
permlink | re-cedricguillas-re-mwfiae-bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job-20180906t102741436z |
category | utopian-io |
json_metadata | {"tags":["utopian-io"],"app":"steemit/0.1"} |
created | 2018-09-06 10:27:42 |
last_update | 2018-09-06 10:27:42 |
depth | 2 |
children | 0 |
last_payout | 2018-09-13 10:27:42 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 0.000 HBD |
curator_payout_value | 0.000 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 479 |
author_reputation | 8,649,692,852,318 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,489,484 |
net_rshares | 425,720,395 |
author_curate_reward | "" |
voter | weight | wgt% | rshares | pct | time |
---|---|---|---|---|---|
sou1iane | 0 | 76,224,407 | 2% | ||
penghuren | 0 | 349,495,988 | 100% |
Hello @mwfiae, This is a really good extensively written report. * The Criticality Is Critical, It affects the resource monitoring majorly and can impact high unnecessary usage. * You proposed a solution, even if it was discarded it was a good initiative. you should try to inform the PO before starting on the fix that you're on it and get assigned to the issue. this resolves problems like 2 people working on the same project. * Other solutions could be to filter request based on `origin` header. the cronjob was the perfect solution. Thanks for including it in your report as well. This report is very valuable and that's why I'll be staff-picking it from Bug-hunting category. Thank you for contributing to this project Your contribution has been evaluated according to [Utopian policies and guidelines](https://join.utopian.io/guidelines), as well as a predefined set of questions pertaining to the category. To view those questions and the relevant answers related to your post, [click here](https://review.utopian.io/result/5/111211). ---- Need help? Write a ticket on https://support.utopian.io/. Chat with us on [Discord](https://discord.gg/uTyJkNm). [[utopian-moderator]](https://join.utopian.io/)
author | sachincool |
---|---|
permlink | re-mwfiae-bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job-20180905t045348043z |
category | utopian-io |
json_metadata | {"tags":["utopian-io"],"users":["mwfiae"],"links":["https://join.utopian.io/guidelines","https://review.utopian.io/result/5/111211","https://support.utopian.io/","https://discord.gg/uTyJkNm","https://join.utopian.io/"],"app":"steemit/0.1"} |
created | 2018-09-05 04:53:48 |
last_update | 2018-09-05 04:53:48 |
depth | 1 |
children | 2 |
last_payout | 2018-09-12 04:53:48 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 5.082 HBD |
curator_payout_value | 1.630 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 1,224 |
author_reputation | 18,548,631,010,973 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,359,805 |
net_rshares | 5,947,210,204,892 |
author_curate_reward | "" |
voter | weight | wgt% | rshares | pct | time |
---|---|---|---|---|---|
yuxi | 0 | 8,988,035,164 | 30% | ||
espoem | 0 | 16,566,701,170 | 15% | ||
utopian-io | 0 | 5,864,639,231,500 | 3.88% | ||
zapncrap | 0 | 2,001,559,740 | 5% | ||
amosbastian | 0 | 3,787,035,109 | 5.76% | ||
curx | 0 | 2,004,849,262 | 5% | ||
mwfiae | 0 | 38,718,681,307 | 100% | ||
lordofreward | 0 | 376,492,317 | 1.5% | ||
mightypanda | 0 | 7,326,245,908 | 25% | ||
hljk | 0 | 209,496,175 | 50% | ||
fastandcurious | 0 | 1,163,943,204 | 35% | ||
mops2e | 0 | 339,728,176 | 10% | ||
bullinachinashop | 0 | 878,113,698 | 35% | ||
awesome-n | 0 | 210,092,162 | 50% |
Thank you very much for the review and the staff-pick! :) It's a shame that the pull-request wasn't merged because I mentioned it a few times... But I could have better used the github features to make it clearer and will certainly pay more attention next time :) Ultimately it only were a few lines of code, so hopefully it didn't cost stoodkev too much time to reimplement it. Also thank you for your valuable feedback! I need to make sure to read more about the origin header :) Greetings, Mw
author | mwfiae |
---|---|
permlink | re-sachincool-re-mwfiae-bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job-20180905t085436121z |
category | utopian-io |
json_metadata | {"tags":["utopian-io"],"app":"steemit/0.1"} |
created | 2018-09-05 08:54:36 |
last_update | 2018-09-05 08:54:36 |
depth | 2 |
children | 0 |
last_payout | 2018-09-12 08:54:36 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 0.000 HBD |
curator_payout_value | 0.000 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 502 |
author_reputation | 8,649,692,852,318 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,376,234 |
net_rshares | 398,164,121 |
author_curate_reward | "" |
voter | weight | wgt% | rshares | pct | time |
---|---|---|---|---|---|
sou1iane | 0 | 76,170,600 | 2% | ||
cheneats | 0 | 321,993,521 | 2% |
Thank you for your review, @sachincool! So far this week you've reviewed 1 contributions. Keep up the good work!
author | utopian-io |
---|---|
permlink | re-re-mwfiae-bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job-20180905t045348043z-20180908t214638z |
category | utopian-io |
json_metadata | "{"app": "beem/0.19.42"}" |
created | 2018-09-08 21:46:39 |
last_update | 2018-09-08 21:46:39 |
depth | 2 |
children | 0 |
last_payout | 2018-09-15 21:46:39 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 0.000 HBD |
curator_payout_value | 0.000 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 113 |
author_reputation | 152,955,367,999,756 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,734,306 |
net_rshares | 0 |
#### Hi @mwfiae! Your post was upvoted by @steem-ua, new Steem dApp, using UserAuthority for algorithmic post curation! Your **UA** account score is currently 3.673 which ranks you at **#5140** across all Steem accounts. Your rank has improved 21 places in the last three days (old rank 5161). In our last Algorithmic Curation Round, consisting of 188 contributions, your post is ranked at **#132**. ##### Evaluation of your UA score: * You're on the right track, try to gather more followers. * The readers like your work! * Your contribution has not gone unnoticed, keep up the good work! **Feel free to join our [@steem-ua Discord server](https://discord.gg/KpBNYGz)**
author | steem-ua |
---|---|
permlink | re-bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job-20180905t143424z |
category | utopian-io |
json_metadata | "{"app": "beem/0.19.54"}" |
created | 2018-09-05 14:34:24 |
last_update | 2018-09-05 14:34:24 |
depth | 1 |
children | 5 |
last_payout | 2018-09-12 14:34:24 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 0.000 HBD |
curator_payout_value | 0.000 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 676 |
author_reputation | 23,214,230,978,060 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,406,477 |
net_rshares | 0 |
Hey steem-ua, thanks for the upvote! But you should increase the time before you vote, as utopian still wasn't here and that would have boosted my post-ua for sure! :) Greetings, mw
author | mwfiae |
---|---|
permlink | re-steem-ua-re-bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job-20180905t143424z-20180905t143809583z |
category | utopian-io |
json_metadata | {"tags":["utopian-io"],"app":"steemit/0.1"} |
created | 2018-09-05 14:38:12 |
last_update | 2018-09-05 14:38:12 |
depth | 2 |
children | 4 |
last_payout | 2018-09-12 14:38:12 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 0.000 HBD |
curator_payout_value | 0.000 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 185 |
author_reputation | 8,649,692,852,318 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,406,862 |
net_rshares | 322,158,994 |
author_curate_reward | "" |
voter | weight | wgt% | rshares | pct | time |
---|---|---|---|---|---|
cheneats | 0 | 322,158,994 | 1.75% |
If they do that, they won't get thr share of curation which will be a loss to them :)
author | mightypanda |
---|---|
permlink | re-mwfiae-re-steem-ua-re-bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job-20180905t143424z-20180905t191847165z |
category | utopian-io |
json_metadata | {"tags":["utopian-io"],"app":"steemit/0.1"} |
created | 2018-09-05 19:18:48 |
last_update | 2018-09-05 19:18:48 |
depth | 3 |
children | 3 |
last_payout | 2018-09-12 19:18:48 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 0.000 HBD |
curator_payout_value | 0.000 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 85 |
author_reputation | 21,847,608,676,835 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,430,415 |
net_rshares | 0 |
Congratulations @mwfiae! You have completed the following achievement on Steemit and have been rewarded with new badge(s) : [](http://steemitboard.com/@mwfiae) Award for the number of upvotes <sub>_Click on the badge to view your Board of Honor._</sub> <sub>_If you no longer want to receive notifications, reply to this comment with the word_ `STOP`</sub> To support your work, I also upvoted your post! **Do not miss the last post from @steemitboard:** [SteemFestยณ - SteemitBoard support the Travel Reimbursement Fund.](https://steemit.com/steemfest/@steemitboard/steemfest-steemitboard-support-the-travel-reimbursement-fund) > Do you like [SteemitBoard's project](https://steemit.com/@steemitboard)? Then **[Vote for its witness](https://v2.steemconnect.com/sign/account-witness-vote?witness=steemitboard&approve=1)** and **get one more award**!
author | steemitboard |
---|---|
permlink | steemitboard-notify-mwfiae-20180905t032244000z |
category | utopian-io |
json_metadata | {"image":["https://steemitboard.com/img/notify.png"]} |
created | 2018-09-05 03:22:42 |
last_update | 2018-09-05 03:22:42 |
depth | 1 |
children | 0 |
last_payout | 2018-09-12 03:22:42 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 0.000 HBD |
curator_payout_value | 0.000 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 939 |
author_reputation | 38,975,615,169,260 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,353,666 |
net_rshares | 0 |
Hey, @mwfiae! **Thanks for contributing on Utopian**. Congratulations! Your contribution was Staff Picked to receive a maximum vote for the bug-hunting category on Utopian for being of significant value to the project and the open source community. Weโre already looking forward to your next contribution! **Get higher incentives and support Utopian.io!** Simply set @utopian.pay as a 5% (or higher) payout beneficiary on your contribution post (via [SteemPlus](https://chrome.google.com/webstore/detail/steemplus/mjbkjgcplmaneajhcbegoffkedeankaj?hl=en) or [Steeditor](https://steeditor.app)). **Want to chat? Join us on Discord https://discord.gg/h52nFrV.** <a href='https://steemconnect.com/sign/account-witness-vote?witness=utopian-io&approve=1'>Vote for Utopian Witness!</a>
author | utopian-io |
---|---|
permlink | re-bug-report-dos-vulnerability-in-the-steemplus-api-caused-by-the-spp-job-20180906t141535z |
category | utopian-io |
json_metadata | "{"app": "beem/0.19.42"}" |
created | 2018-09-06 14:15:36 |
last_update | 2018-09-06 14:15:36 |
depth | 1 |
children | 0 |
last_payout | 2018-09-13 14:15:36 |
cashout_time | 1969-12-31 23:59:59 |
total_payout_value | 0.000 HBD |
curator_payout_value | 0.000 HBD |
pending_payout_value | 0.000 HBD |
promoted | 0.000 HBD |
body_length | 784 |
author_reputation | 152,955,367,999,756 |
root_title | "[Steemplus API] [v1.0] [Bug-Report] DOS Vulnerability in the API caused by the SPP-Job" |
beneficiaries | [] |
max_accepted_payout | 1,000,000.000 HBD |
percent_hbd | 10,000 |
post_id | 70,508,236 |
net_rshares | 0 |