# Cache poisoning Denial of Service affecting assets.gitlab-static.net

GCP origin honored x-http-method-override: HEAD, and Varnish CDN cached the empty response, letting an attacker poison GitLab's JS/CSS assets into a site-wide DoS.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: youstin
- Disclosed: 2021-12-22
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1160407
- Library page: https://bugbountylibrary.com/r/h1%3A1160407
- Tags: area:cloud domain:infra domain:web impact:dos kind:bounty platform:hackerone sev:high tech:cdn technique:chained vuln:cache-poisoning vuln:dos vuln:misconfiguration

**Target:** Varnish CDN fronting GCP-hosted static assets (assets.gitlab-static.net)
**Root cause:** GCP origin accepts x-http-method-override and returns an empty HEAD body, while Varnish neither includes the header in the cache key nor processes it, so the empty response is cached and served to GET requests.
**Steps:**
1. Request a JS asset with a cache-buster: `GET /assets/...chunk.js?cb=youstin-xyz` with header `x-http-method-override: HEAD`
2. Origin returns empty body (HEAD semantics); Varnish caches it under the GET URL
3. Fetch the same URL with a normal GET to confirm empty response is served from cache
4. Use `PURGE` (allowed unauthenticated) to clear cache for live assets, then poison them
**How found:** Researcher inspected response headers, noticed Varnish caching (Age/X-Cache HIT), hypothesized the GCP origin's default x-http-method-override support could produce a cacheable empty response since the header isn't in the cache key.
**Exploitation:** Attacker sends GET with x-http-method-override: HEAD plus a cache-buster to poison arbitrary asset URLs; PURGE clears existing cached entries so live JS/CSS can be replaced with empty responses, breaking gitlab.com for all users.
**Escalation:** Chaining unauthenticated PURGE with the method-override poisoning allows targeting already-cached live assets, turning a per-URL poison into a full site DoS.
**Insight:** When a CDN fronts a cloud origin, test origin-specific headers (x-http-method-override, x-forwarded-*, range) that alter response bodies but aren't in the CDN cache key; also check whether PURGE/BAN methods are exposed unauthenticated to weaponize poisoning against already-cached live assets.