# Attachments may be hijacked via AppCache+CookieBombing trick (bc3_production_blobs bucket)

Basecamp attachment bucket served user uploads as text/html, letting an attacker AppCache-poison the bucket path and hijack all future attachment downloads.

- Payout: hidden
- Severity: high
- Program: Basecamp
- Found by: hudmi
- Disclosed: 2020-11-26
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/403602
- Library page: https://bugbountylibrary.com/r/h1%3A403602
- Tags: area:cloud domain:cloud impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high tech:gcp tech:s3 technique:chained vuln:business-logic vuln:misconfiguration

**Target:** Google Cloud Storage bucket bc3_production_blobs serving Basecamp attachments
**Root cause:** Attachments in the bc3_production_blobs bucket can be served with attacker-controlled response-content-type=text/html, so uploaded HTML executes on the storage origin and can register an AppCache manifest scoped to the bucket path.
**Steps:**
1. Log in to 3.basecamp.com, open a project campfire, upload an HTML file with `<html manifest="[manifest_url]">` plus a cookie-bombing script.
2. Upload a CACHE MANIFEST with `FALLBACK: /bc3_production_blobs/ [fallback_url]`.
3. Upload a fallback HTML page that alerts `location.href`.
4. Extract direct Google Storage links and strip the `response-content-disposition` param; append `&response-content-type=text/html`.
5. Visit the attacker HTML URL so the browser caches the manifest for the bucket path.
6. Open any other bc3_production_blobs direct link; the fallback page loads instead, proving hijack.
**How found:** Noticed attachments are stored in a shared GCS bucket and that the signed URL's response-content-type can be overridden to text/html, then applied the known AppCache+CookieBombing bucket-hijack technique from Detectify research.
**Exploitation:** Attacker uploads HTML to the shared bucket, forces victim to load it (served as text/html), which registers an AppCache manifest with a FALLBACK rule covering /bc3_production_blobs/. All subsequent requests to that bucket path are served from the attacker's fallback page, hijacking every attachment download; a cookie bomb degrades the victim further.
**Escalation:** AppCache FALLBACK scoped to the whole bucket path means one poisoned visit hijacks all future attachment links, not just one file.
**Insight:** When a storage bucket serves user uploads, test whether response-content-type/response-content-disposition query params are attacker-controllable on signed URLs; a shared origin plus AppCache FALLBACK can turn one upload into a persistent hijack of the entire bucket path.