# $1800 in less than an hour.

Indeed Chrome extension API stored a javascript: URL in job applications, and a broken CSRF token allowed Flash-based CSRF to trigger stored XSS on jobox.indeed.com.

- Payout: $1,800
- Severity: medium
- Program: Indeed
- Credited: yappare
- Disclosed: 2018-01-17
- Write-up quality: 6/10
- Original: http://c0rni3sm.blogspot.com/2018/01/1800-in-less-than-hour.html
- Library page: https://bugbountylibrary.com/r/blog%3Ac0rni3sm-blogspot-com-2018-01-1800-in-less-than-hour-html
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium tech:rest technique:chained technique:source-review vuln:csrf vuln:xss

**Target:** jobox.indeed.com /api/jobApplication and Indeed Chrome extension
**Root cause:** The jobApplication API accepted an arbitrary javascript: URL in the 'url' field without validation, and the INDEED_CSRF_TOKEN was not properly validated, allowing cross-site submission.
**Steps:**
1. Install the Indeed Chrome extension and proxy traffic to observe POST /api/jobApplication on jobox.indeed.com.
2. Submit `{"status":"WISHLIST","url":"javascript:alert(0)","notes":"test","jobTitle":"test","companyName":"test","userId":"1"}` and confirm the javascript: URL is stored and later executed.
3. Note the CSRF token is not validated, so craft a cross-site request.
4. Use a Flash-based JSON CSRF technique (sp1d3r tool) with an `<embed src='.../test.swf?jsonData={...}&php_url=.../test.php&endpoint=https://jobox.indeed.com/api/jobApplication?>'` to submit the payload cross-origin.
5. Victim visiting the attacker page stores the javascript: payload, which executes on jobox.indeed.com when viewed.
**How found:** Chose a less-participant target (the Indeed Chrome extension) within the wildcard scope, proxied extension traffic in Burp, and noticed the jobApplication API accepted a javascript: URL; then tested CSRF token validation and found it ineffective.
**Exploitation:** Attacker hosts a malicious HTML page embedding a SWF that sends a JSON POST to jobox.indeed.com/api/jobApplication with a javascript: URL payload, bypassing the unvalidated CSRF token; the stored payload executes in the victim's session on jobox.indeed.com.
**Insight:** Browser extensions in scope often call backend APIs with weaker CSRF/validation than the main site; proxy the extension and look for stored fields that accept javascript: URLs, then chain with JSON CSRF via Flash when tokens aren't enforced.