# How I could have taken over any Pinterest account

Pinterest's UserSettingsResource validated CSRF token only on POST; converting to GET bypassed validation, letting an attacker change victim email and reset password for account takeover.

- Payout: $2,400
- Severity: high
- Program: Pinterest
- Credited: Arnold Anthony
- Disclosed: 2019-01-05
- Write-up quality: 6/10
- Original: http://infosecflash.com/2019/01/05/how-i-could-have-taken-over-any-pinterest-account/
- Library page: https://bugbountylibrary.com/r/blog%3Ainfosecflash-com-2019-01-05-how-i-could-have-taken-over-any-pinterest-account
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high tech:rest technique:chained vuln:account-takeover vuln:csrf

**Target:** Web application settings endpoint /_ngjs/resource/UserSettingsResource/update/
**Root cause:** CSRF token (X-CSRFToken header) was validated only for POST requests; the same endpoint accepted GET requests without token validation, and the settings update logic trusted the data parameter regardless of method.
**Steps:**
1. Send POST /_ngjs/resource/UserSettingsResource/update/ with X-CSRFToken header and settings params; observe it works.
2. Remove X-CSRFToken header from POST; observe error '/resource/UserSettingsResource/update/ didn't finish after 8 seconds' indicating token validation.
3. Change method to GET, drop X-CSRFToken header, keep params; observe 200 OK.
4. Craft GET URL with data JSON setting email to attacker-controlled address and username to dummyuser.
5. Victim clicks link; their email/username change to attacker values.
6. Attacker visits /password/reset/, enters the now-victim email, receives reset link, resets password and logs in.
**How found:** While browsing Pinterest, noticed CSRF tokens passed via X-CSRFToken header. Tested validation by removing the header from a POST (got error), then converted the POST to GET without the header and got 200 OK, revealing method-dependent token validation.
**Exploitation:** Attacker crafts a GET link to the settings update endpoint embedding a JSON data parameter that sets the victim's email to an attacker-controlled address and username to dummyuser. Victim clicks the link (no CSRF token needed since GET bypasses validation). Attacker then uses Pinterest's password reset flow with the new email to receive a reset link and take over the account.
**Escalation:** Chained CSRF email change with the standard password reset flow to convert a settings modification into full account takeover.
**Insight:** When CSRF tokens are enforced via a custom header, test whether the same endpoint accepts alternate HTTP methods (GET) that skip token validation; also check if the endpoint accepts a JSON blob in a query parameter, which makes a tokenless GET fully state-changing.