0

During a recent security assessment of one of our applications, a key vulnerability was identified regarding the absence of rate limiting on the /file endpoint.   Vulnerability Description The /file endpoint, which appears to be an inherent Mendix endpoint rather than one we explicitly exposed ourselves, currently allows unrestricted requests, even at high volumes. During testing, approximately 9000 brute-force attempts were made on the GUID parameter within a 2-minute window (about 48 requests per second). This lack of throttling could allow a malicious actor to potentially brute-force the GUID and download confidential files from the database.   Recommendation The security team recommended implementing rate-limiting controls to mitigate brute-force attacks. Specifically, they suggested limiting the number of requests per user or source IP address within a defined time frame (e.g., 10 requests per 10 seconds).   Challenge I’m looking for a way to implement rate limiting on a specific endpoint in Mendix, particularly the /file endpoint. I’ve found a marketplace module that throttles requests to microflows, but this doesn't meet the requirement, as it doesn't directly protect file downloads or the /file endpoint itself.   Has anyone implemented rate limiting on a Mendix application, especially for file downloads or similar endpoints? I’m looking for guidance or solutions to address this security concern effectively.   Any advice or insights would be greatly appreciated. Thanks in advance!

asked 2025-01-27

1 answers