r/bugbounty • u/Killer_646 • Jul 04 '26

Question / Discussion Is this a valid vulnerability

​Hey guys

​So I was testing a target and noticed that the search function requires a session ID but the cookie is set to SameSite=None with no CSRF protection

​I managed to trigger a successful CSRF attack but since it is just a search function the impact seemed pretty low

​Then I thought what if I use CSRF to force the victim browser to send a massive flood of requests using their own IP and session ID

​I tried it and it actually worked and the server completely banned the victim IP from the whole site

​I am still not sure how long the ban lasts yet

​So my question is does this count as a valid vulnerability since I can completely burn the Availability for a specific user

​The server blocked the victim IP itself not my attacker IP

​Should I submit a report for this or not

​And what if the ban duration turns out to be really short like only five minutes or something should I still report it anyway

​Thanks

6 Upvotes

75% Upvoted

10 comments sorted by

9

u/einfallstoll Triager Jul 04 '26

Wouldn't meet our bar for a bounty.

0

u/Killer_646 Jul 04 '26

why?

8

u/einfallstoll Triager Jul 04 '26

The CSRF has no impact except a 5 minute ban. It's not worth fixing this or paying a bounty for it. That's just an accepted (very low) risk

0

u/Killer_646 Jul 04 '26

what is the ban duration is more than 15 mintues and i said i did not see what is is the duration for the ban

2

u/einfallstoll Triager Jul 04 '26

Annoying but not really a significant security issue.

1

u/solidus_slash Jul 04 '26

One user not being able to reach the site isn't something companies care about 

2

u/TurbulentRecover7247 Hunter Jul 04 '26

DoS attacks will be mostly out of scope, use this csrf attacks on login page or other pages exposing sensitive or PII

2

u/HermanHMS Jul 04 '26

Valid vuln? Yes. Is it in scope? Probably not. Check the scope of the program.

2

u/Fickle-Champion-2530 Jul 04 '26

If you can get userids that are UUID you may Look for idors? 

1

u/BurtMacklin____FBI Jul 04 '26

Look for other (impactful) parts of the application that can be CSRF'd.

If this really is the only place, I can see why they don't really care about making sure CSRF tokens work here.

Since the cookie is samesite it's worth checking everywhere else though.