# How I could have hijacked a victim’s YouTube notifications! (Google VRP Writeup)

YouTube's push-notification registration endpoint lacked CSRF protection, letting an attacker rebind a victim's notifications to their own webhook and read them.

- Payout: unconfirmed
- Severity: medium
- Program: Google
- Credited: Yash Sodha
- Disclosed: 2019-03-26
- Write-up quality: 6/10
- Original: https://hackademic.co.in/youtube-bug/
- Library page: https://bugbountylibrary.com/r/blog%3Ahackademic-co-in-youtube-bug
- Tags: domain:web impact:data-leak kind:bounty platform:blog sev:medium tech:websocket technique:source-review vuln:csrf

**Target:** POST /notifications_ajax?action_register_device=1 on www.youtube.com
**Root cause:** The service-worker-driven push registration endpoint accepted multipart form POSTs with no CSRF token or origin check, unlike other YouTube endpoints.
**Steps:**
1. Enable notifications on YouTube and capture `POST /notifications_ajax?action_register_device=1` with `endpoint`, `device_id`, `p256dh_key`, `auth_key`, `permission=granted`.
2. Note Referer is `https://www.youtube.com/sw.js` (service worker) and no CSRF token is present.
3. Generate attacker push credentials locally: register a service worker, request notification permission, call `pushManager.subscribe()` to obtain endpoint/p256dh/auth keys.
4. Build an auto-submitting multipart form to the YouTube endpoint with attacker's endpoint/keys and `permission=granted`.
5. Victim visits attacker page; their YouTube push subscription is overwritten to attacker's webhook.
6. Trigger a victim notification (e.g. comment on private video) and receive it on attacker's endpoint.
**How found:** While enabling notifications late at night, noticed the registration request carried push keys and lacked a CSRF token; the Referer being sw.js explained why it bypassed the usual CSRF protections, prompting a PoC.
**Exploitation:** Attacker hosts a page that auto-submits the multipart form to YouTube's registration endpoint using attacker-controlled push credentials; victim's browser sends it with cookies, rebinding notifications to the attacker's webhook so all future YouTube notifications are delivered to the attacker.
**Insight:** Service-worker-originated requests often skip CSRF protections other endpoints have; check push/notification registration endpoints for missing origin checks and rebindable webhook parameters.