# Cache poisoning using NULL bytes and long URLs

NULL byte in `for` param of Greenhouse embed JS injects arbitrary long strings into applicationURI, poisoning cached JS and causing DoS via oversized URLs.

- Payout: hidden
- Severity: medium
- Program: Greenhouse.io
- Found by: irvinlim
- Disclosed: 2018-09-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/334709
- Library page: https://bugbountylibrary.com/r/h1%3A334709
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:cdn technique:incomplete-fix vuln:cache-poisoning vuln:crlf-injection vuln:dos

**Target:** boards.greenhouse.io embed job_board JS endpoint
**Root cause:** The `for` parameter is copied verbatim into generated JS (boardURI/applicationURI) without sanitization; a `%00` terminates the customer key but trailing data still propagates into the cached JS.
**Steps:**
1. Request `https://boards.greenhouse.io/embed/job_board/js?for=surveymonkey%00` followed by ~6155 bytes of padding and a suffix like `654321`.
2. Observe generated `Grnhse.Settings` with `applicationURI` containing the injected long string.
3. The poisoned JS is cached on Greenhouse CDN and served from the clean URL `...?for=surveymonkey`.
4. Victim loads job application page; the long `applicationURI` prefix plus `&token=XXXXXXX` exceeds ~6169 bytes, causing `ERR_CONNECTION_CLOSED`.
**How found:** Follow-up to prior report 326639 on arbitrary string injection in the same endpoint; realized NULL byte terminates the key while allowing a very large injected string to propagate into cached JS, then measured URL length limits to trigger connection close.
**Exploitation:** Attacker poisons the cached JS for a target customer key via NULL-byte injection with a near-max-length URL; subsequent visitors to the embed job application iframe get a URL exceeding server limits, resulting in denial of service.
**Insight:** When a parameter is reflected into cached JS, test NULL-byte termination to bypass key validation while still injecting trailing data; measure server URL length limits to convert reflection into DoS.