Security Test: Sensitive endpoint bruteforce¶

Description¶

Default Severity: medium

If an endpoint doesn't limit how often users can send requests, attackers can flood it with attempts until they succeed in guessing valid credentials or other secret information. This oversight usually comes from developers assuming that other parts of the system handle such checks or by not properly implementing rate limiting at this point. Without proper limits, a bad actor can effectively try countless variations, which could eventually lead to unauthorized access or service disruption—especially dangerous when sensitive data or critical functions are exposed.

Reference:

• https://developer.redis.com/howtos/ratelimiting/

Configuration¶

Identifier: access_control/sensitive_endpoint_bruteforce

Examples¶

All configuration available:

checks:
  access_control/sensitive_endpoint_bruteforce:
    skip: false # default

Compliance and Standards¶