Summary
A race condition vulnerability allows an attacker to bypass the enforced limit on unanswered direct messages. Although the application restricts users to sending only four unanswered messages (returning an error after the limit is reached), multiple concurrent requests can bypass this restriction, allowing 20+ messages to be sent successfully.
Vulnerability Type
Race Condition
Business Logic Bypass
Rate Limit Bypass
Affected Endpoint
POST /direct_messages
Affected URL
https:
Description
The application enforces a restriction on the number of unanswered direct messages a user can send. After sending four messages, any additional request receives the following error:
There was a problem saving reply:
Your sender user can not additional unanswered messages today
This indicates the server checks whether the sender has exceeded the allowed number of unanswered messages before creating a new message.
However, this validation is not performed atomically. By sending multiple concurrent requests to the POST /direct_messages endpoint, each request passes the validation before the message count is updated.
As a result, multiple requests are accepted simultaneously, allowing the attacker to exceed the intended messaging limit. During testing, I successfully sent more than 20 messages, despite the application enforcing a limit of four.
Steps to Reproduce
Log in to an Amplenote account.
Navigate to:
https:
Send messages until reaching the limit (4 unanswered messages).
Attempt to send another message normally.
Observe the server returns:
There was a problem saving reply:
Your sender user can not additional unanswered messages today
Capture the following request:
POST /direct_messages
Example body:
{
"direct_message": {
"body_content": "batman",
"receiver_user_id": 253130,
"reply_to_direct_message_id": 270
}
}
Send multiple copies of the same request simultaneously using Burp Suite Repeater (group send) or Turbo Intruder.
Observe that numerous requests succeed.
Verify that more than the intended four unanswered messages have been created (20+ in my testing).
Proof of Concept
Normal behavior:
Send 4 unanswered messages → Success
5th message → Blocked
Returned error:
There was a problem saving reply:
Your sender user can not additional unanswered messages today
Race condition:
Send multiple concurrent POST /direct_messages requests.
Multiple requests are processed successfully.
More than 20 unanswered messages are created, bypassing the intended restriction.
Impact
This vulnerability allows attackers to bypass the application's anti-spam restriction, which can lead to:
Circumvention of direct message limits.
Spam or message flooding against other users.
Increased server resource consumption.
Abuse of the messaging system beyond intended business rules.
If the limit is intended to mitigate spam or harassment, bypassing it significantly weakens that protection.
Root Cause
The server validates the sender's unanswered message count before creating a new message, but the validation and message creation are not performed atomically. Concurrent requests execute the validation simultaneously before the shared state is updated, allowing multiple requests to pass the limit check.
Remediation
Implement atomic enforcement of the unanswered message limit by:
Performing the validation and message creation within a database transaction.
Applying row-level locking or other synchronization mechanisms during the limit check.
Re-validating the limit immediately before committing the transaction.
Rejecting concurrent requests once the configured limit has been reached.
CWE
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)
Severity
Medium
The vulnerability bypasses an intended server-side business restriction designed to limit direct messaging and prevent abuse. While it does not directly expose sensitive data or enable account compromise, it allows attackers to circumvent anti-spam protections and send significantly more messages than intended.