T09 · Insecure Skill Coding Practices
Warning
- Location
workflows/lead-magnet.json:253- Finding
Spoofable Client-IP Rate Limiting Enables Email and Storage Abuse
- Content
View full analysis
now - ts < windowMs); if (limits[key].length === 0) delete limits[key]; } // Check rate limit const requests = limits[ip] || []; if (requests.length >= maxRequests) { throw new Error(`Rate limit exceeded for ${ip}`); } // Record this request requests.push(now); limits[ip] = requests; // Pass through return $input.all(); ``` ### Technical Analysis The rate limit uses `X-Forwarded-For` or `X-Real-IP` directly as its client identity. These headers can normally be supplied by the requesting client unless a trusted reverse proxy removes and reconstructs them. The code neither verifies that the request traversed a trusted proxy nor parses a trusted hop from a forwarding chain. Consequently, an attacker can select a new rate-limit key for every request by changing the header value. Each fabricated value receives a separate allowance of ten requests per hour. The issue affects both public workflows. Successful requests can update Google Sheets and trigger SMTP messages; the lead-magnet workflow also attaches the configured PDF. ### Attack Path 1. The attacker identifies the public `/webhook/newsletter` or `/webhook/lead-magnet` endpoint. 2. The attacker submits a valid-looking JSO ...[truncated 1001 chars]- Remediation
View remediation