[dubsmash] Long String in 'shoutout' Parameter Leading Internal server Error on Popular hastags , Community and User Profile
该报告还没有中文解读。
原文摘录
摘自原文（18857 字符中的一小部分）
Summary: If the user input a long string in the 'shoutout' parameter of the 'CreateVideo' API then all the APIs where this video is supposed to appear (eg: hashtag API, community API, and user profile API) will throw 'internal server error' in the response. This will cause a denial of service …
原文中的代码
POST /graphql?build_number=52430&platform=ios HTTP/2 Host: gateway-production.dubsmash.com Content-Type: application/json X-Device-Country: IN Accept: application/json Authorization: Bearer xxxxxx X-Dubsmash-Device-Id: 8F15E960-B1C5-4C30-A100-CA0527827502 X-Accept-Content-Language: en_IN …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Reddit 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @sandeep_rj49 · 版权归作者与 Reddit 所有