Resource Consumption in Serverless-Todo API Endpoint

Executive Summary

This vulnerability is an unauthenticated resource consumption flaw in the serverless-todo application's /api/todos endpoint. It allows remote attackers to send large or high-cardinality JSON payloads without validation, causing increased Lambda execution costs, DynamoDB write pressure, CloudWatch log growth, and potential availability issues.

Useful 0 Not Useful 0

Detection Guidance

• Monitor API Gateway access logs for unusually large POST requests to /api/todos. Look for payloads exceeding typical Todo item sizes or request bodies over 1MB.
• Check CloudWatch Logs for Lambda function invocations with high execution duration or memory usage spikes, indicating resource consumption.
• Use AWS WAF to inspect request patterns. Set up custom rules to detect and block requests with large JSON arrays or high item counts in the payload.
• Deploy a test payload with 160 Todo objects (251,570 bytes) to the /api/todos endpoint and observe system behavior for resource exhaustion signs.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this by sending a large JSON array to the endpoint, which is accepted and stored. This leads to resource exhaustion, higher cloud service costs, degraded application performance, and potential downtime due to overwhelmed backend services like DynamoDB and Lambda.

Useful 0 Not Useful 0

Mitigation Strategies

• Implement server-side validation in the Lambda handler to enforce maximum payload size, Todo item count, and title length before processing.
• Configure API Gateway request validation to reject malformed or excessively large JSON payloads at the gateway level.
• Set up AWS WAF rate-based rules to limit the number of requests per IP address, preventing brute-force exploitation.
• Apply Lambda reserved concurrency to cap the number of concurrent executions and prevent runaway resource consumption.

Useful 0 Not Useful 0