# DoS attacks utilizing camo.stream.highwebmedia.com

Camo image proxy lacked timeout and chunked-response size limits, letting attacker-hosted images exhaust proxy sockets/bandwidth and crash visitor browsers.

- Payout: $400
- Severity: medium
- Program: Chaturbate
- Credited: teuvokas
- Disclosed: 2019-05-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/507525
- Library page: https://bugbountylibrary.com/r/h1%3A507525
- Tags: domain:web impact:dos impact:internal-access kind:bounty platform:hackerone sev:medium tech:nginx technique:recon vuln:dos vuln:ssrf

**Target:** camo.stream.highwebmedia.com image proxy (Camo Asset Proxy 2.5.0)
**Root cause:** Proxy enforced neither a response timeout when trickled data arrived every ~9s nor a size cap on Transfer-Encoding: chunked responses lacking Content-Length.
**Steps:**
1. Host slow.php returning 500 + chunked, flushing 4KB every 9s for 200 iterations.
2. Host big.php returning 500 + chunked 1GB body; big_valid.php serving a 457MB valid PNG.
3. Embed `<img src="http://attacker/slow.php">` etc. in a White Label homepage intro or verified profile HTML.
4. Proxy rewrites to `https://camo.stream.highwebmedia.com/<sha>/<url>`; fetch repeatedly with `curl --resolve` to hit origin IPs directly.
5. Observe requests pending ~1500-1800s in nginx log; 3 concurrent big.php fetches yield >600 Mbps egress.
6. Load white-label page in Chrome with big_valid.php to crash browser.
**How found:** Noticed proxy fetches user-linked images; hypothesized missing timeout/size controls; tested slowloris-style trickle and chunked oversized bodies, confirming via nginx access logs and netstat.
**Exploitation:** Attacker controls image URLs embedded in user-rendered content; proxy fetches them server-side. Trickled chunked responses hold proxy connections open ~30min (socket exhaustion); chunked 1GB bodies without Content-Length bypass size limits to saturate bandwidth/memory; valid huge PNGs crash end-user browsers. Cache disabled via 500 status or random query string turns proxy into DoS relay against third parties.
**Escalation:** Bypass CDN via --resolve to origin IPs; disable caching (500 status or random query) to weaponize proxy against external sites; redirect-following extends reach.
**Insight:** Image/asset proxies that fetch user-supplied URLs are SSRF/DoS surfaces: test whether they honor Content-Length-only size limits (chunked bypass), enforce read timeouts on trickled bytes, and cache 500 responses—each is a lever for resource exhaustion or proxied attacks.