# Bug bounty left over (and rant) Part III (Google and Twitter)

Periscope OAuth redirect_uri accepted path traversal (`/../../asanso`), letting an attacker redirect the OAuth flow and hijack victim access tokens.

- Payout: $5,040
- Severity: high
- Program: Google, Twitter
- Credited: Antonio Sanso
- Disclosed: 2018-02-06
- Write-up quality: 6/10
- Original: https://blog.intothesymmetry.com/2018/02/bug-bounty-left-over-and-rant-part-iii.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-intothesymmetry-com-2018-02-bug-bounty-left-over-and-rant-part-iii-html
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:oauth technique:source-review vuln:auth-bypass vuln:open-redirect vuln:path-traversal

**Target:** OAuth 2 authorization endpoint (periscope.tv/oauth)
**Root cause:** The OAuth server validated redirect_uri by prefix/string match rather than exact match, so appending `/../../asanso` to a registered URI passed validation while resolving to an attacker-controlled path.
**Steps:**
1. Identify client_id `catbzQMNEwPxwfvEMqgMFHbNTcwWevGiDRWUaq3aHERZfgnCuy` with registered redirect_uri `https://getmevo.com/oauth/periscope`.
2. Request `https://www.periscope.tv/oauth?client_id=catbzQMNEwPxwfvEMqgMFHbNTcwWevGiDRWUaq3aHERZfgnCuy&redirect_uri=https://getmevo.com/oauth/periscope/../../asanso&error=true`.
3. Observe the server accepts the traversed redirect_uri instead of rejecting it.
4. Lure a victim through the crafted authorize URL so the resulting access token is delivered to the attacker-controlled path.
**How found:** Inspired by filedescriptor's Periscope OAuth writeup; author, an OAuth 2 specialist, reviewed the new Periscope OAuth implementation and tested redirect_uri manipulation, recalling identical bugs previously found on Facebook and GitHub.
**Exploitation:** Attacker crafts an OAuth authorize link using a legitimate client_id but a redirect_uri that traverses out of the registered path (`/../../asanso`). Because validation is not exact-match, the server redirects the victim's authorization response (including the access token) to the attacker's location, hijacking the token.
**Insight:** When an OAuth server validates redirect_uri by prefix or path rather than exact string equality, try appending `/../` traversal segments to a registered URI to escape into an attacker-controlled path while still passing validation.