# HTTP request smuggling on Basecamp 2 allows web cache poisoning

CL/TE desync on Basecamp 2 let an authenticated user smuggle a request with X-Forwarded-Host, poisoning the cache with an off-site redirect for all visitors.

- Payout: hidden
- Severity: critical
- Program: Basecamp
- Found by: hazimaslam
- Disclosed: 2020-10-28
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/919175
- Library page: https://bugbountylibrary.com/r/h1%3A919175
- Tags: area:web domain:web impact:ato impact:data-leak impact:mass-exploit kind:bounty platform:hackerone sev:critical technique:chained vuln:cache-poisoning vuln:host-header vuln:request-smuggling

**Target:** basecamp.com front-end/back-end HTTP stack
**Root cause:** Front-end and back-end disagree on request boundaries: duplicate Transfer-Encoding headers (chunked vs identity) plus Content-Length cause desync, and the front-end caches responses keyed without regard to the smuggled X-Forwarded-Host.
**Steps:**
1. Send `POST /4618984/account` with both `Content-Length: 144` and conflicting `Transfer-Encoding: chunked` / `Transfer-encoding: identity` headers.
2. Body contains a chunk `22` with `_method=patch&account%5Bname%5D=BC`, then `0`, then a smuggled `GET /x HTTP/1.1` with `X-Forwarded-Host: <attacker>` and `X-Forwarded-Proto: http`.
3. Front-end honors Content-Length, back-end honors chunked TE, leaving the smuggled GET in the socket queue.
4. Next victim request on the poisoned socket is answered with the off-site redirect generated from X-Forwarded-Host.
5. Confirm via RequestBin capture that the smuggled request reached the attacker-controlled host.
**How found:** Redirect probe revealed front-end caching behavior; noticing duplicate/conflicting Transfer-Encoding headers were accepted led to testing CL/TE desync and combining it with X-Forwarded-Host to poison the cache.
**Exploitation:** Attacker (authenticated Basecamp 2 user) sends the crafted CL/TE request; the smuggled GET with attacker-controlled X-Forwarded-Host is prepended to the next user's request, producing a redirect response that the front-end cache stores, persistently redirecting all subsequent visitors to the attacker domain.
**Escalation:** Cached redirect persists for all visitors; redirecting JS imports to attacker domain enables keylogger/password theft on login page and capture of visitors' headers and cookies.
**Insight:** When a target reflects X-Forwarded-Host in redirects, check whether the front-end caches those responses and whether conflicting Transfer-Encoding headers (chunked vs identity) are tolerated — desync turns a reflected redirect into a persistent cache poison.