DEF CON 34 – BugBounty – How Cache Poisoning Led to Critical Acct Takeover in TikTok’s Web – G Chong

Web cache poisoning is often written off as a class of vulnerabilities with limited real-world impact. Most reported instances only expose non-sensitive user metadata, cause temporary, minor disruptions to static content, or require such narrow, impractical conditions to exploit that they rarely move beyond theoretical proof-of-concept. For TikTok’s Vulnerability Management team, this framing shaped our initial approach to triaging cache poisoning submissions for years—until two radical researcher submissions upended that assumption entirely, proving misconfigured web caches can undermine every pillar of the CIA triad (confidentiality, integrity, availability) to enable catastrophic, scalable harm. In this talk, we’ll start with a foundational breakdown of web cache poisoning: common misconfigurations (from flawed cache key logic to mishandled origin headers) that enable exploitation, and the limited impact profiles that led our team (and many in the bug bounty ecosystem) to historically deprioritize these flaws. We’ll then deep dive into the game-changing submissions that reshaped our security posture and why security teams and bug bounty hunters must re-evaluate how they assess cache poisoning risk—moving past surface-level assumptions about limited impact to audit for hidden, critical exploit pathways. Whether you triage web vulnerabilities, build global web infrastructure, or hunt for bugs at scale, this session will equip you to spot and remediate cache poisoning risks before they’re weaponized against your users.DEFCONConferenceRead More