Security vulnerabilities and automated fixes for dos prevention issues
2 posts found
The k-skill-proxy server exposed multiple public API endpoints (`/health`, `/v1/vworld/search`, `/v1/fine-dust/report`, `/v1/assembly/bills`) without consistent rate limiting middleware, leaving them vulnerable to denial-of-service attacks. A `buildRateLimiter` function existed but wasn't applied to all endpoints. This fix ensures rate limiting is enforced on all public endpoints, preventing resource exhaustion attacks.
A high-severity denial of service vulnerability in `src/index.js` allowed attackers to exhaust server resources through unlimited requests to `/api/register` and `/api/captcha`. The fix implements in-memory rate limiting middleware, restricting captcha generation to 20 requests per minute and registration to 10 requests per minute per IP.