# Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack

x-forwarded-scheme header on hackerone.com caused a cached 301 redirect loop on static assets, enabling DoS of JS/CSS/images via Cloudflare cache poisoning.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: youstin
- Disclosed: 2021-12-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1181946
- Library page: https://bugbountylibrary.com/r/h1%3A1181946
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:cdn technique:recon vuln:cache-poisoning vuln:dos vuln:host-header

**Target:** Cloudflare-cached static assets on hackerone.com
**Root cause:** Origin trusts the x-forwarded-scheme header and issues a 301 redirect to the same URL when scheme is http; Cloudflare caches the redirect, so subsequent requests without the header still hit the poisoned cached redirect.
**Steps:**
1. Send `GET /assets/static/js/8.9572d249.chunk.js?hackerone=poc HTTP/2` with `Host: hackerone.com` and `x-forwarded-scheme: http`
2. Observe 301 redirect to the same page, cached by Cloudflare
3. Re-request without the header; cached 301 persists, causing a redirect loop
4. Repeat on the real asset path without cachebuster to make the file inaccessible
**How found:** Researcher noticed Cloudflare caching static files and tested whether the origin honored the x-forwarded-scheme header, discovering it produced a self-redirect that got cached.
**Exploitation:** Attacker sends a single request with x-forwarded-scheme: http to any cached static asset URL; Cloudflare caches the resulting self-referential 301, making the asset unreachable for all users and breaking pages that depend on it.
**Escalation:** Applies to any cached file (JS, CSS, images), potentially causing total loss of availability of hackerone.com.
**Insight:** On Cloudflare-fronted sites, test x-forwarded-scheme/x-forwarded-proto and similar scheme headers on cacheable static paths with a cachebuster; a self-referential redirect that gets cached turns a single request into persistent DoS.