Laravel nova 3.7.0 range dos Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2020-12-04 | Type : webapps | Platform : php
This exploit / vulnerability Laravel nova 3.7.0 range dos is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Exploit Title: Laravel Nova 3.7.0 - 'range' DoS
# Date: June 22, 2020
# Exploit Author: iqzer0
# Vendor Homepage: https://nova.laravel.com/
# Software Link: https://nova.laravel.com/releases
# Version: Version v3.7.0
# Tested on: Manjaro / Chrome v83

An authenticated user can crash the application by setting a higher
value to the 'range' (default 30) parameter and sending simultaneous
requests (10 simultaneous requests was enough to DoS the server in my
testing)

Vulnerable URL:
https://example.com/nova-api/metrics/sum-orders?timezone=Indian%2FMaldives&twelveHourTime=true&range=3000000
Vulnerable Parameter: range