PayPal · Report #622122
DoS on PayPal via web cache poisoning
Validstatus
mediumseverity
$9,700bounty
851upvotes
23 Oct 2019disclosed
Summary
On https://paypal.com/, you could impact core functionality by using an invalid Transfer-Encoding header to replace JavaScript files from www.paypalobjects.com with the message '501 Not Implemented'. This was patched and awarded a $9,700 bounty.
By the time you read this, there should be a full writeup on this technique at https://portswigger.net/research/responsible-denial-of-service-with-web-cache-poisoning
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.