Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv

Summary

By modifying the Content-Type to be blank, during a PUT command, the researcher was able to upload files to the CDN. This has been resolved.

It was possible to write (and overwrite) arbitrary files to the CDN ( vpe.cdn.vimeo.tv ) used for JS scripts delivery on the various in-scope assets using the PUT method with blank or application/octet-stream Content-Type. Any other Content-Type caused auth error from Google Cloud Storage side. Example:

PUT /something.js HTTP/1.1
Host: vpe.cdn.vimeo.tv
Content-Type: application/octet-stream
Content-Length: 10
Connection: close

alert(document.domain)

could create something.js with XSS payload or overwrite something.js if it already exist.

The issue was fixed fast. Thanks to the VHX team for the great experience, awesome communication and the bounty!