# Bypass of request line length limit to DoS via cache poisoning

Incomplete fix: 1024-char URI limit bypassed with multi-byte UTF-8 chars, re-enabling cache poisoning of Greenhouse embed JS to cause DoS.

- Payout: hidden
- Severity: medium
- Program: Greenhouse.io
- Found by: irvinlim
- Disclosed: 2018-09-16
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/350847
- Library page: https://bugbountylibrary.com/r/h1%3A350847
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:cdn technique:incomplete-fix technique:unicode-normalization vuln:cache-poisoning vuln:dos

**Target:** boards.greenhouse.io /embed/job_board/js endpoint and its CDN cache
**Root cause:** The prior fix limited request URI length to 1024 characters after URL-decoding, but multi-byte UTF-8 characters expand up to 12 URL-encoded bytes each, so the reflected boardURI/applicationURI can still exceed the server's ~6169-byte limit.
**Steps:**
1. Note the fix from report #334709 caps decoded request URI at 1024 characters.
2. Use `%00` to truncate the board token and inject a payload into the reflected boardURI.
3. Repeat a 4-byte UTF-8 char (e.g. `♥` = `%E2%99%A5`, 9 bytes) 992 times to amplify decoded length up to 12x.
4. Send `curl --http1.1 -s "https://boards.greenhouse.io/embed/job_board/js?for=a%00<repeated ♥>623145"` to poison the cached JS.
5. Resultant boardURI exceeds 6169 bytes, causing ERR_CONNECTION_CLOSED for all users of the poisoned cache entry.
**How found:** Researcher knew the prior fix limited URI length to 1024 characters after decoding, hypothesized UTF-8 chars count as one character but expand to up to 12 URL-encoded bytes, and tested with repeated ♥ to confirm amplification bypasses the limit.
**Exploitation:** Attacker sends a single crafted request to the embed JS endpoint with a NULL byte and repeated multi-byte UTF-8 characters; the reflected boardURI in the cached JS exceeds the server limit, so the poisoned cache entry serves a broken response, denying service to job boards/iframes on client sites.
**Insight:** When a length limit is applied after decoding, check whether multi-byte/percent-encoded characters amplify byte length; also look for reflected input in cached responses where a NULL byte truncates the token.