# Header modification results in disclosure of Slack infra metadata to unauthorized parties

files.slack.com honored X-Forwarded-Host with an @-suffix bypass of host validation, yielding blind SSRF from backend AWS hosts for intranet port scanning.

- Payout: hidden
- Severity: medium
- Program: Slack
- Found by: showuon
- Disclosed: 2021-06-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/727330
- Library page: https://bugbountylibrary.com/r/h1%3A727330
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:medium tech:aws technique:blind vuln:host-header vuln:ssrf

**Target:** files.slack.com file-pri endpoint (CDN/backend proxy)
**Root cause:** Backend honors X-Forwarded-Host instead of Host for routing; host validation only checks the Host header and is bypassed by appending @domain to the X-Forwarded-Host value.
**Steps:**
1. Upload a file, capture `GET https://files.slack.com/files-pri/TNXC4JD70-FPSL307RB/test.png` in Burp.
2. Add `X-Forwarded-Host: xxx.com` -> server returns 500 (validation).
3. Change to `X-Forwarded-Host: files.slack.com@YOUR_DOMAIN` -> 302 with Location pointing to YOUR_DOMAIN/files-pri/...
4. Observe request arrives at your domain from an *.amazonaws.com backend host (not CloudFront).
5. Replace YOUR_DOMAIN with intranet IP:port (e.g. `169.254.169.254:PORT`) and infer open/closed ports via response delay.
**How found:** Noticed the server honored X-Forwarded-Host rather than Host; the 500 on a plain foreign host suggested validation, and appending @files.slack.com-style userinfo bypassed it, confirmed by a 302 to attacker domain from an AWS backend IP.
**Exploitation:** Attacker-controlled X-Forwarded-Host with @-suffix makes the backend issue requests to arbitrary hosts/ports; blind, so only timing/redirect behavior is observable.
**Insight:** When a proxy validates Host but routes on X-Forwarded-Host, try userinfo-style `trusted.host@attacker` payloads to satisfy the check while redirecting the actual destination; confirm backend origin via the connecting IP (amazonaws vs cloudfront).