# DoS via Automatic Response Message

Mattermost auto-responder message field lacked size validation, letting any user store 50MB payloads via /users/me/patch and crash the server.

- Payout: hidden
- Severity: medium
- Program: Mattermost
- Found by (vendor credit): vultza (vultza)
- Found by: vultza
- Disclosed: 2022-11-23
- CVE: CVE-2022-4044
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1680241
- Library page: https://bugbountylibrary.com/r/h1%3A1680241
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:dos

**Target:** REST API endpoint /api/v4/users/me/patch (auto_responder_message)
**Root cause:** The auto_responder_message notify property has no length/size validation, so arbitrarily large strings (up to nginx's 50MB body limit) are accepted and persisted.
**Steps:**
1. Login as normal user, capture MMAUTHTOKEN and X-CSRF-TOKEN.
2. Generate 50MB payload: `python2.7 -c "print 'A' * 50000000"`.
3. Send `PUT /api/v4/users/me/patch` with body `{"notify_props":{"auto_responder_active":"true","auto_responder_message":"<payload>"}}`.
4. Fire 5 concurrent requests via curl loop with cookie and CSRF header.
5. Server exhausts resources and crashes, becoming unavailable to all users.
**How found:** Researcher noticed the auto-responder message field accepted arbitrary input with no size check, then tested maximum payload sizes bounded by nginx's default body limit.
**Exploitation:** Any authenticated user sends concurrent 50MB auto-responder message updates; the server cannot handle/update the large stored data and crashes, denying service to all users.
**Insight:** Profile user-controlled free-text profile/notification fields for missing length caps; combine with the reverse proxy's max body size to find the largest storable payload and test concurrent writes for resource exhaustion.