TikTok paid three bounties for one bug because it fixed endpoints, not the root cause

Fixing only the endpoint where a bug was found can invite more bypasses, said G Chong of TikTok at DEF CON 34. She spoke in a bug bounty talk on cache poisoning. A bounty is a payment to an outside researcher who reports a flaw. TikTok paid three of them for one underlying problem.

What was said

Chong described three reports of account takeover. A cache is a store that serves saved copies of web responses. Here, cached responses carried a login code. An attacker could grab the code and trade it for a token.

After the first report, Chong said, TikTok made two fixes. The server stopped issuing redirects when a code sat in the location header. The CDN, the network that caches content, stopped storing certain URL paths. Looking back, she said, it was easy to see how a clever attacker could bypass this kind of block list.

The second report did exactly that. The researcher used an invalid language path, and the server redirected it. The login code leaked through the cached response. TikTok then made invalid paths return a 404 error and turned off caching for them.

The third report bypassed that fix too. It used path traversal, a trick that makes a path end up somewhere other than where it starts. The server returned a cached 404. A secondary header still leaked the whole URL, login codes included.

Chong said TikTok marked the first two reports as resolved. When the third arrived, it had paid three separate bounties. Her warning: "Just because a report is marked as resolved may not mean that it's actually resolved."

Why it matters

Our reading is that a block list treats the symptom someone has already shown you. The attacker only needs the next variation. Each narrow fix can then buy a new report, and a new payout, instead of ending the problem.

For managers, that makes "resolved" a claim to test. Chong's own lessons point to the root. Check cache keys. Enforce strict allow lists on login state values. Never let user-controlled URLs decide where someone lands after login. Before closing a ticket, ask whether the fix addresses the cause or only the reported path.

The other side

This is one company's account of three cases, told by a member of its own team. The excerpts describe researcher reports. They do not say whether anyone abused the flaws in the wild.

Chong did not claim that fixing the root cause is quick. The excerpts give no cost or timeline for that fix. Whether paying three times cost more than a deeper fix the first time is not something the talk answered.