# Flickr API Explorer – Force users to execute any API request.

Flickr API Explorer failed to validate its CSRF magic_cookie, letting an attacker force any logged-in user to execute state-changing API calls like commenting or favoriting.

- Payout: $100
- Severity: medium
- Program: Flickr
- Credited: Brett Buerhaus
- Disclosed: 2015-02-03
- Write-up quality: 6/10
- Original: https://buer.haus/2015/02/03/flickr-api-explorer-force-users-to-execute-any-api-request/
- Library page: https://bugbountylibrary.com/r/blog%3Abuer-haus-2015-02-03-flickr-api-explorer-force-users-to-execute-any-api-request
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium tech:oauth technique:source-review vuln:auth-bypass vuln:csrf

**Target:** Flickr App Garden API Explorer render/explore endpoint
**Root cause:** The API Explorer's magic_cookie CSRF token was not actually validated or required, so POST requests to the explore endpoint executed without a valid token.
**Steps:**
1. Identify state-changing API methods exposed at `https://www.flickr.com/services/api/explore/<method>`.
2. Craft an auto-submitting POST form to the explore endpoint with `method`, `sign_call=full`, `param_*` fields, and empty `magic_cookie`.
3. Victim loads the page while logged into Flickr; the form submits inside an iframe and the API call executes as the victim.
**How found:** Author noted sites typically use CSRF token blacklists rather than whitelists, hypothesized the magic_cookie might not be enforced, and confirmed the API Explorer requests executed without a valid token.
**Exploitation:** Attacker hosts an auto-submitting HTML form targeting the API Explorer explore endpoint with sign_call=full and empty magic_cookie; when a logged-in victim visits, the state-changing API call (e.g. addComment) executes as them inside an iframe.
**Insight:** Developer-facing API test consoles that auto-sign calls as the logged-in user are high-value CSRF targets; test whether their CSRF token is actually enforced by omitting it entirely rather than only sending invalid values.