Insufficient JWT Verification in Rate Limiter Middleware Enables Denial of Service

Summary

Note: This finding affects Outline v1.5.0.
This vulnerability affects the rate limiting middleware protecting the Outline API.

1. It was identified that the key derivation process used by the rate limiting middleware for authenticated requests did not adequately verify the legitimacy of the authentication token in the request.
2. As such, an attacker can forge an invalid token pointing to a victim user and perform many requests to a distinct API endpoint using this forged token.
3. Should the number of requests exceed the configured limit for the targeted endpoint, the attacker can effectively induce a Denial of Service on the targeted endpoint for the impersonated victim user.
4. This attack can be used to attack any/all API endpoints configured with rate limiting.

Details

The key derivation function utilized by the rateLimiter middleware (/server/middlewares/rateLimiter.ts) insecurely determines the userID to use as the key for the rate limiter.

The getRateLimiterIdentifier function uses the parseAuthentication method from /server/middlewares/authentication to deduce whether a token is passed to the request, and thereby determine if its authenticated or not.

Should a token be passed through any of the supported mechanisms (Authorization Header, Cookie, etc), the getJWTPayload method will be used to decode it. However, this method only decodes the token, it does not verify it.

export function getJWTPayload(token: string) {
  let p…