No ratelimiting bug

[Susinder-R]

Context

I have identified that when Forgetting Password for account , the request has no rate limit which then can be used to loop through one request. Which can be annoying to the root users sending mass password to one email.

Steps to Reproduce

1.Go To This Link https://carto.com/password_resets/new
Enter Email Click On Forget Password
2.Intercept This Request In Burp And Forward Till You Found Your Number In Request Like {"email":"your email here"}
3.Now Send This Request To Intruder And Repeat It 100 Time By Fixing Any Arbitrary Payload Which Doesn't No Effect Request I Choose Accept-Language: en-US,en;q=0.$5$
4. See You Will Get 200|302 ok Status Code & 100 + Email In Your INBOX
See It Is Resulting In Mass Mailing Or Email Bombing To Your Users Which Is Bad For Business Impact

Expected result

I Will Recommend You To Add A ReCaptcha & Sort Of Something Which Requires Manual Human Interaction To Proceed Like You Can Add Captcha Like 2+2=___ so that it cannot be brute forced and you also can have a limit at the backend for particular number upto 5 times a day user can request Forget Password Email or Link something like that will prevent you from someone exploiting this vulnerability

Browser and version

FireFox78.0.2 (64-bit)

Additional info

Post request of my reset password mail id:

POST /password_resets HTTP/1.1
Host: carto.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://carto.com/
Content-Type: application/x-www-form-urlencoded
Content-Length: 170
Origin: https://carto.com
Connection: close
Cookie: _ga=GA1.2.217582385.1594492705; _gid=GA1.2.1560404638.1594495052; __hstc=124960853.7b2f13351629b4768a576701d20fec7c.1594495092506.1594532652043.1594534255363.4; hubspotutk=7b2f13351629b4768a576701d20fec7c; _fbp=fb.1.1594499396749.1747950695; messagesUtk=96515cc597814e9eb1cb6f67b8b094ef; __hssc=124960853.5.1594534255363; _hjid=e3f09062-e44f-4d81-bae8-46f97ba108f4; _hjIncludedInSample=1; __hssrc=1; utm_source=; utm_medium=; utm_campaign=; utm_content=; utm_term=; _hjAbsoluteSessionInProgress=1; _cartodb_session=WGNsbUZZSDgyYkFEbk41alRDb21TZ0xqUE9LeDN5SXZhdVc3YitpUlRVZ1ZhZnhPK0dlb1hieWh5bS9VeTN6WjdrL3RwRk9LQzNvc1ppYlF3U0tpMXNzZUxvN0lzS3QvOHZIT2dwazF2K2RaVEo5YU1sMnduZzd1M3RZa2hkODRlbGoyc21zVXlWaThGRW0zYW5QQmpkWlN3MXBPa1d0UFJENzBCdWZqajd0T29scFFnU25SbUR3dy9mWVF6QjMyLS1Dc2tVRHRzcEwxYmhvVHhkRmF6TWJRPT0%3D--2f49fcf1ce33cee5329cdbf864166ddf3c63a862
Upgrade-Insecure-Requests: 1

utf8=%E2%9C%93&authenticity_token=DqEE5tanqZ%2FVmqWTebtEF7ipumwkgPL2FllDl3IswHRqPYZtHNizvaGu23yj2OFNbFtPEw2V%2BHE7sNEZTA9q%2BA%3D%3D&email=sujithrottlerz%40protonmail.com

{"email":"[email protected]"}

1 attachment:
https://user-images.githubusercontent.com/68180945/87246252-d1482d80-c469-11ea-9d59-93d5bfdd843e.jpg
2attachment:
https://user-images.githubusercontent.com/68180945/87246306-3b60d280-c46a-11ea-826c-afe05d56a826.jpg
3attachment:
https://user-images.githubusercontent.com/68180945/87246325-592e3780-c46a-11ea-9757-bb9d4e36ab78.jpg
4attachment:
https://user-images.githubusercontent.com/68180945/87246352-7e22aa80-c46a-11ea-82d7-1271f8fa57ae.jpg
5attachment:
https://user-images.githubusercontent.com/68180945/87246369-9db9d300-c46a-11ea-9eb2-29934c843aa7.jpg
6attachment:
https://user-images.githubusercontent.com/68180945/87246390-c17d1900-c46a-11ea-9715-1f3b5e36aaba.jpg
7attachment:
https://user-images.githubusercontent.com/68180945/87246401-d9ed3380-c46a-11ea-9064-c2d3cd8c0be4.jpg
8attachment:
https://user-images.githubusercontent.com/68180945/87246416-05701e00-c46b-11ea-892c-7007917935c8.jpg