# $10k host header

Host header injection against App Engine let an outsider reach internal googleplex.com app YAQS, exposing a Google Confidential internal site.

- Payout: $10,000
- Severity: high
- Program: Google VRP
- Credited: Ezequiel Pereira
- Disclosed: 2019-01-18
- Write-up quality: 6/10
- Original: https://www.ezequiel.tech/p/10k-host-header.html
- Library page: https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-10k-host-header-html
- Tags: domain:cloud impact:internal-access kind:bounty platform:blog sev:high tech:gcp technique:recon vuln:access-control vuln:auth-bypass vuln:host-header

**Target:** App Engine *.appspot.com frontend routing to internal *.googleplex.com apps
**Root cause:** App Engine routed requests based on the attacker-controlled Host header, and the internal app yaqs.googleplex.com lacked the Googler-account check that other internal apps enforced.
**Steps:**
1. Send `GET /eng HTTP/1.1` with `Host: yaqs.googleplex.com` to the App Engine frontend (www.appspot.com:443 over HTTPS)
2. Observe redirect to /eng and internal content marked 'Google Confidential'
3. Equivalent PoC: `curl -k "https://yaqs.googleplex.com" --resolve "yaqs.googleplex.com:443:172.217.28.180"`
**How found:** Enumerated internal hostnames via `site:googleplex.com` Google search, then fuzzed Host headers on App Engine requests in Burp; most internal apps returned 404 or enforced @google.com account checks, but yaqs.googleplex.com did neither.
**Exploitation:** Attacker connects to the public App Engine endpoint but sets Host to an internal googleplex.com hostname; the frontend proxies to the internal app, bypassing the MOMA/ÜberProxy login gate because that app did not verify the Googler username.
**Escalation:** Google noted variants existed that would have allowed access to sensitive data, raising the reward.
**Insight:** When a shared frontend routes by Host header, enumerate internal-only hostnames (search engine dorking on the internal domain) and replay them against the public frontend; apps that skip the SSO/account check are the ones that leak.