sc-rate-limiting

SC: Rate Limiting & DoS Vectors

Purpose

Detects missing rate limiting on sensitive endpoints and application-level denial-of-service vectors including ReDoS patterns, GraphQL complexity attacks, large payload attacks, pagination abuse, connection pool exhaustion, and resource-intensive operations without throttling.

Activation

Called by sc-orchestrator during Phase 2. Runs against all web applications and APIs.

Phase 1: Discovery

Keyword Patterns to Search

"rateLimit", "rate_limit", "throttle", "RateLimiter",
"express-rate-limit", "slowapi", "throttle_classes",
"@Throttle", "bucket", "leaky", "sliding_window"

Checks

1. Missing Rate Limiting on Sensitive Endpoints:

• Login/authentication endpoints
• Password reset
• Registration/signup
• OTP/verification code sending
• Email sending endpoints
• API key generation
• File upload
• Search/query endpoints

2. ReDoS (Regular Expression Denial of Service):

// VULNERABLE: Catastrophic backtracking
const emailRegex = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;
// Input: "aaaaaaaaaaaaaaaaaaaaaaaa!" causes exponential backtracking

// SAFE: Non-backtracking regex or use validator library
const { isEmail } = require('validator');

3. Pagination Abuse:

// VULNERABLE: No upper bound on limit
app.get('/api/users', (req, res) => {
  const limit = parseInt(req.query.limit) || 10;
  // limit=999999 returns entire database!
});

// SAFE: Cap the limit
const limit = Math.min(parseInt(req.query.limit) || 10, 100);

4. Request Size Limits:

// VULNERABLE: No body size limit
app.use(express.json());  // Default: 100kb, but should be explicitly set

// SAFE: Explicit limit
app.use(express.json({ limit: '1mb' }));

Severity Classification

• Critical: ReDoS causing server hang, missing rate limit on auth allowing brute force
• High: Missing rate limits on financial operations, unbounded queries
• Medium: Missing rate limits on non-critical endpoints, large payload acceptance
• Low: Minor DoS vectors requiring sustained attack, informational