# Cache poisoning DoS to various TTS assets

Malformed X-CF-APP-INSTANCE header forces Cloud Foundry gorouter to return 404, which CloudFront caches, poisoning TTS assets for new users.

- Payout: hidden
- Severity: high
- Program: GSA Bounty
- Found by: nathand
- Disclosed: 2020-03-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/728664
- Library page: https://bugbountylibrary.com/r/h1%3A728664
- Tags: area:cloud domain:cloud domain:web impact:dos kind:bounty platform:hackerone sev:high tech:cdn technique:recon vuln:cache-poisoning vuln:dos vuln:misconfiguration

**Target:** Cloud Foundry gorouter behind CloudFront CDN (federation.data.gov and other TTS assets)
**Root cause:** Gorouter returns a cacheable 404 when X-CF-APP-INSTANCE names a nonexistent app instance, and the fronting CDN caches that error response keyed on URL.
**Steps:**
1. Send `GET /?cb=xxx` to the asset with header `X-CF-APP-INSTANCE: xxx:1` (cache buster avoids poisoning real homepage).
2. Gorouter responds 404 'Requested route ... does not exist'.
3. CDN caches the 404 for that URL.
4. Verify with `curl -i https://federation.data.gov/?cb=xxx` (no cookies) returning 404.
**How found:** Researcher knew of CPDoS (cpdos.org) and hypothesized Cloud Foundry's debug X-CF-APP-INSTANCE header could force a cacheable 404 from gorouter; tested against TTS assets, confirmed on four, and found login.gov immune likely due to not caching 404s.
**Exploitation:** Attacker repeatedly sends the malformed header request (script loops via openssl s_client) to poison the CDN cache; subsequent new users without cookies receive the cached 404, causing DoS. Regional poisoning possible by targeting CDN edge IPs from VPSs.
**Escalation:** Targeting regional CloudFront edge IPs to poison specific regions; error also leaks internal cloud.gov hostname.
**Insight:** Cloud Foundry's X-CF-APP-INSTANCE debug header yields a cacheable 404 at gorouter; test any CF-fronted asset behind a CDN for CPDoS, and note such requests may bypass app logs since they fail at gorouter.