# Denial of service via cache poisoning

X-Forwarded-Port header poisoned the cache on www.hackerone.com, persistently redirecting all users to an invalid port and blocking access.

- Payout: $2,500
- Severity: medium
- Program: HackerOne
- Credited: albinowax
- Disclosed: 2018-12-22
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/409370
- Library page: https://bugbountylibrary.com/r/h1%3A409370
- Tags: domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:incomplete-fix vuln:cache-poisoning vuln:dos vuln:host-header

**Target:** Drupal web frontend behind caching layer (www.hackerone.com)
**Root cause:** The cache key omits the X-Forwarded-Port header, but the origin reflects it into the Location header of a 302 redirect, so a poisoned response is cached and served to all users.
**Steps:**
1. Send `curl -H 'X-Forwarded-Port: 123' https://www.hackerone.com/index.php?dontpoisoneveryone=1`
2. Observe 302 with `Location: https://www.hackerone.com:123/`
3. Load the same URL in a browser to confirm the poisoned redirect is served from cache
4. Alternatively use `X-Forwarded-Host: www.hackerone.com:123`
**How found:** After the Drupal cache poisoning patch landed on hackerone.com, Kettle attempted to bypass the patch and noticed the X-Forwarded-Port header was still reflected into redirect Location headers and not part of the cache key.
**Exploitation:** A single unauthenticated request with a spoofed X-Forwarded-Port header causes the cache to store a redirect to a non-listening port; every subsequent visitor to that URL times out, persistently denying access.
**Insight:** When a patch blocks one unkeyed header, enumerate sibling forwarding headers (X-Forwarded-Port, X-Forwarded-Host, X-Forwarded-SSL) that may still be reflected into redirects or scheme decisions and remain outside the cache key.