# Cache Deception Allows Account Takeover

Abritel search URL with .jpeg suffix was cached by CDN while reflecting HASESSIONV3 session token, letting attackers steal sessions and take over accounts.

- Payout: hidden
- Severity: high
- Program: Expedia Group Bug Bounty
- Found by: bombon
- Disclosed: 2023-04-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1698316
- Library page: https://bugbountylibrary.com/r/h1%3A1698316
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high technique:recon vuln:account-takeover vuln:cache-deception vuln:info-disclosure

**Target:** www.abritel.fr search endpoint and traveler profile page
**Root cause:** The search endpoint reflected the HASESSIONV3 session cookie in a 200 response, and the CDN cached responses whose URL ended in a static extension like .jpeg, storing the victim's session token in a shared cache.
**Steps:**
1. Victim visits `https://www.abritel.fr/search/keywords:soissons-france-(xss)/minNightlyPrice/x.jpeg?triagethis`
2. Attacker requests the same URL (or `curl ... | grep -i HASESSIONV3`) and retrieves the cached response containing the victim's HASESSIONV3 token
3. Attacker sends `GET /traveler/profile/edit` with `Cookie: HASESSIONV3=<stolen token>`
4. Attacker reads the `ha.crumb` token from the profile edit page response
**How found:** Researcher noticed the session token was reflected in the search page response and that appending a .jpeg extension caused the caching layer to treat the response as cacheable, combining the two into a cache deception attack.
**Exploitation:** Attacker lures victim to a search URL ending in .jpeg so the CDN caches the 200 response containing the reflected session token; attacker then fetches the same URL to read the cached token and replays it against /traveler/profile/edit to obtain the ha.crumb token and hijack the account.
**Insight:** Look for endpoints that reflect session cookies in 200 responses, then append static extensions (.jpeg, .css, .js) to see if the CDN caches them; a reflected session token plus extension-based cache rules yields cross-user session theft.