# DoS via Playbook

Normal user sets 50MB run_summary_template in a Mattermost Playbook; running it exhausts server resources and crashes the instance for all users.

- Payout: hidden
- Severity: medium
- Program: Mattermost
- Found by (vendor credit): vultza (vultza)
- Found by: vultza
- Disclosed: 2022-11-23
- CVE: CVE-2022-4019
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1685979
- Library page: https://bugbountylibrary.com/r/h1%3A1685979
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:rest vuln:dos vuln:misconfiguration

**Target:** Playbooks plugin REST API (plugins/playbooks/api/v0/playbooks)
**Root cause:** Playbook fields run_summary_template, retrospective_template and description lack size validation, so a user can store up to 50MB (nginx default limit) per field; rendering this on run exhausts server resources.
**Steps:**
1. Log in as normal user, capture MMAUTHTOKEN and X-CSRF-TOKEN.
2. Build JSON payload with run_summary_template set to 50,000,000 characters.
3. `curl -X POST http://<domain>/plugins/playbooks/api/v0/playbooks -H 'Content-Type: application/json' -d @payload --cookie 'MMAUTHTOKEN=<token>' -H 'X-CSRF-TOKEN: <csrf>'`
4. Open playbook page, click Run, name the run.
5. Server consumes abnormal CPU/memory and crashes within seconds; app unavailable to all users.
**Exploitation:** Authenticated low-priv user stores a 50MB template via the playbooks API, then triggers a run; the server processes the oversized template, exhausting resources until crash. Restart leaves the run page and channel blank, preventing cleanup.
**Insight:** Template/summary fields on workflow plugins often skip length limits that the main message API enforces; test each playbook attribute (run_summary_template, retrospective_template, description) at nginx body-size ceiling and trigger the run to see if rendering is unbounded.