Skip to main content

Message flooding

Need​

Mitigation of message flooding attacks

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for Java Servlet development

Description​

Non compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class MessageServlet extends HttpServlet {

    public void doPost(HttpServletRequest request, HttpServletResponse response) {
        String recipient = request.getParameter("recipient");
        String message = request.getParameter("message");

        // send the message without any rate limiting
        sendMessage(recipient, message);
    }

    private void sendMessage(String recipient, String message) {
        // Code to send the message to the recipient
    }
}

The above code is a simple servlet that handles POST requests to send a message to a recipient. The recipient and the message are passed as parameters in the request.

The vulnerability here is that there is no rate limiting or flood control implemented. This means that an attacker could potentially send a large number of requests to this endpoint, causing a flood of messages to be sent to the recipient.

This could lead to the saturation of the recipient's inbox, consume resources on the server, and potentially cause a denial of service. This is a form of attack commonly known as a "flood attack" or "message flooding".

In this case, the vulnerable part is the doPost method, which does not implement any form of rate limiting or flood control. It simply takes the parameters from the request and sends the message, regardless of how many requests are made.

Steps​

  • Implement rate limiting to restrict the number of messages that can be sent within a certain time period.
  • Validate the recipient's contact information to ensure it is a valid phone number or email address.
  • Implement a mechanism to detect and block suspicious or abusive behavior, such as sending a large number of messages to different recipients.
  • Monitor and log message sending activity to identify any unusual patterns or spikes in message volume.
  • Consider implementing a CAPTCHA or other challenge-response mechanism to prevent automated message flooding.
  • Educate users about the risks of message flooding and encourage them to report any suspicious activity.

Compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.concurrent.TimeUnit;
import com.google.common.util.concurrent.RateLimiter;

public class MessageServlet extends HttpServlet {

    private static final RateLimiter rateLimiter = RateLimiter.create(1.0); // 1 message per second

    public void doPost(HttpServletRequest request, HttpServletResponse response) {
        String recipient = request.getParameter("recipient");
        String message = request.getParameter("message");

        // Validate recipient
        if (!isValidRecipient(recipient)) {
            throw new IllegalArgumentException("Invalid recipient");
        }

        // Check rate limit
        if (!rateLimiter.tryAcquire(1, TimeUnit.SECONDS)) {
            throw new IllegalStateException("Rate limit exceeded");
        }

        // send the message
        sendMessage(recipient, message);
    }

    private boolean isValidRecipient(String recipient) {
        // Code to validate the recipient's contact information
        return true;
    }

    private void sendMessage(String recipient, String message) {
        // Code to send the message to the recipient
    }
}

The updated code includes a rate limiter that restricts the number of messages that can be sent within a certain time period. In this case, the rate is set to 1 message per second. If a user tries to send more than this limit, an IllegalStateException is thrown.

The doPost method now also includes a call to isValidRecipient, a method that validates the recipient's contact information. If the recipient is not valid, an IllegalArgumentException is thrown. This method should be implemented to check whether the recipient's phone number or email address is valid.

These changes help to prevent message flooding by limiting the rate at which messages can be sent and ensuring that messages are only sent to valid recipients. They also provide a mechanism for detecting and blocking suspicious or abusive behavior, such as sending a large number of messages to different recipients.

References​

Last updated on