GHSA Q2vm P36g W596

BlueprintUE v4.3.2 allows unauthenticated users to create blueprints repeatedly without effective rate limiting or anonymous storage quotas.

Each submission creates a database record and a separate file on the server. Anonymous users can select never expiration, causing these records to remain stored indefinitely and bypass the observed automatic expiration cleanup.

An attacker can exploit this to consume server storage and potentially cause denial of service for legitimate users.

Open BlueprintUE without logging in.

Intercept an anonymous blueprint creation request using Burp Suite.

Submit a valid blueprint payload beginning with begin.

Select never as the expiration option.

Send the request and observe successful blueprint creation.

Repeat the request with additional payloads. (No size limit)

Inspect the database and server storage directory.

Repeated submissions are accepted without an effective rate limit being observed.

Every successful submission creates a separate database record and storage file.

Records are associated with the anonymous user.

Non-expiring records are excluded from the observed automatic cleanup process.

Seven stored files of 12,202,951 bytes each were observed during testing.

An unauthenticated attacker can repeatedly consume persistent server storage without creating an account.

At sufficient volume, this can exhaust available disk space, disrupt application operations, and prevent legitimate users from creating blueprints or using affected functionality.

Based on the observed file size, just 100 successful submissions could consume approximately 1.14 GB of storage.

Recommended Mitigations

Implement rate limiting for anonymous blueprint creation.

Enforce storage quotas for anonymous users.

Apply a strict maximum blueprint-content size.

Restrict never-expiring blueprints for anonymous users.

Clean up abandoned anonymous blueprints.

Reporter - @mr-farhankhan