# Cache Poisoning DoS on downloads.exodus.com

Crafted Authorization header caused Azure storage 403 that Cloudflare cached on downloads.exodus.com, letting an attacker DoS file downloads for all users.

- Payout: hidden
- Severity: high
- Program: Exodus
- Found by: youstin
- Disclosed: 2021-12-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1173153
- Library page: https://bugbountylibrary.com/r/h1%3A1173153
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:high tech:azure tech:cdn vuln:cache-poisoning vuln:dos

**Target:** Cloudflare-fronted Azure storage download subdomain
**Root cause:** Cloudflare caches responses keyed without the Authorization header, so an Azure 403 triggered by a malformed SharedKeyLite header gets stored and served to all users.
**Steps:**
1. Send `GET /releases/hashes-exodus-21.2.12.txt?cachebuster=hackerone` with header `Authorization: SharedKeyLite myaccount:ctzMq410TV3wS7upTBcunJTDLEJwMAZuFPfr0mrrA08=` to downloads.exodus.com
2. Observe 403 from Azure storage origin
3. Re-request same URL without the Authorization header and observe the cached 403
4. Repeat on real file URLs near cache expiry to poison live cache
**How found:** Researcher noticed downloads.exodus.com files are Azure-hosted and Cloudflare-cached, then tested whether an Authorization header could alter the origin response and be cached.
**Exploitation:** Attacker sends a request with a malformed SharedKeyLite Authorization header to a cacheable file URL, causing Azure to return 403; Cloudflare caches that 403 and serves it to all subsequent users, blocking downloads.
**Insight:** On CDN-fronted storage, test whether request headers that change origin status (Authorization, Range, X-Forwarded-*) are part of the cache key; a header-induced 403/404 can be cached and served to everyone.