Missing Rate Limiters on Management Endpoints
Description:
Several administrative and management endpoints lack rate limiting protections, leaving them vulnerable to Denial of Service (DoS) attacks through database spamming or resource exhaustion.
Affected Endpoints (backend/secuscan/routes.py):
@router.delete("/tasks/bulk")@router.delete("/tasks/clear")@router.post("/target-policies"), @router.patch("/target-policies/{policy_id}"), @router.delete("/target-policies/{policy_id}")@router.post("/credential-profiles"), @router.patch(...), @router.delete(...)@router.post("/session-profiles"), @router.patch(...), @router.delete(...)@router.get("/plugins"), @router.get("/presets")@router.post("/workflows"), @router.patch("/workflows/{workflow_id}")
Recommendation:
Apply an appropriate rate limiter (such as admin_limiter or read_heavy_limiter) via Depends(...) to all management endpoints to prevent abuse.
Missing Rate Limiters on Management Endpoints
Description:
Several administrative and management endpoints lack rate limiting protections, leaving them vulnerable to Denial of Service (DoS) attacks through database spamming or resource exhaustion.
Affected Endpoints (backend/secuscan/routes.py):
@router.delete("/tasks/bulk")@router.delete("/tasks/clear")@router.post("/target-policies"),@router.patch("/target-policies/{policy_id}"),@router.delete("/target-policies/{policy_id}")@router.post("/credential-profiles"),@router.patch(...),@router.delete(...)@router.post("/session-profiles"),@router.patch(...),@router.delete(...)@router.get("/plugins"),@router.get("/presets")@router.post("/workflows"),@router.patch("/workflows/{workflow_id}")Recommendation:
Apply an appropriate rate limiter (such as
admin_limiterorread_heavy_limiter) viaDepends(...)to all management endpoints to prevent abuse.