# Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv

Blank/octet-stream Content-Type on PUT to vpe.cdn.vimeo.tv allowed arbitrary file write/overwrite, enabling stored XSS on embed.vhx.tv for all customers.

- Payout: hidden
- Severity: high
- Program: Vimeo
- Found by: sp1d3rs
- Disclosed: 2019-07-10
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/452559
- Library page: https://bugbountylibrary.com/r/h1%3A452559
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:cdn technique:source-review vuln:access-control vuln:misconfiguration vuln:xss

**Target:** Google Cloud Storage-backed CDN (vpe.cdn.vimeo.tv) serving JS for embed.vhx.tv
**Root cause:** CDN PUT endpoint accepted writes when Content-Type was blank or application/octet-stream, bypassing the auth check that GCS enforced for other Content-Types.
**Steps:**
1. Send `PUT /something.js HTTP/1.1` to `Host: vpe.cdn.vimeo.tv` with `Content-Type: application/octet-stream` and body `alert(document.domain)`
2. Observe file created (or existing file overwritten) on the CDN
3. Load the script via embed.vhx.tv to trigger stored XSS for all customers
**How found:** Researcher noticed GCS returned auth errors for normal Content-Types but blank/octet-stream bypassed the check, then tested PUT to write files.
**Exploitation:** Attacker uploads or overwrites a JS file served by the CDN used by embed.vhx.tv; any customer loading that script executes attacker JS in their origin context.
**Insight:** When a CDN fronts object storage, try omitting or neutering Content-Type on write methods—auth logic keyed on headers can be bypassed by edge-case values like blank or application/octet-stream.