# ok.ru mobile: CSRF bypass via st.rtu redirect deletes photos

CSRF token bypass on m.ok.ru via nested st.rtu redirect parameter lets an attacker delete a victim's photo through a crafted reshare link.

- Payout: hidden
- Severity: medium
- Program: ok.ru
- Found by: bohdansec
- Disclosed: 2016-03-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/102376
- Library page: https://bugbountylibrary.com/r/h1%3A102376
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:chained technique:param-pollution vuln:access-control vuln:csrf

**Target:** m.ok.ru mobile web endpoints (dk action bus, friendReshareTopic, userPhoto)
**Root cause:** The st.rtu redirect parameter is followed server-side and its nested actionBus payload executes actions (photos.delete) without validating the CSRF token, so the X-XTKN token requirement is bypassed.
**Steps:**
1. Craft a friendReshareTopic URL with st.rtu containing a nested /dk?bk=ActionBus&st.cmd=actionBus payload.
2. Inside the nested st.rtu place st.cmd=userPhoto with st.phoId set to the victim's photo id and st.actions={"photos.delete":{"photoId":"<id>","groupId":null}}.
3. Send the link to the victim; when they click the cancel button on the reshare, the nested actionBus fires and deletes the photo.
**How found:** Researcher previously bypassed CSRF via dlgId and page links, then noticed ajax requests with X-XTKN token could be smuggled through the st.rtu parameter used in note/group-post editing and reposts.
**Exploitation:** Attacker delivers a crafted reshare link; victim interaction (clicking cancel) triggers the nested actionBus photos.delete action server-side, deleting the target photo without a valid CSRF token.
**Insight:** Redirect/return-url parameters (st.rtu) that are followed server-side and can nest another actionBus command are a CSRF bypass vector: chain a state-changing action inside the redirect payload to skip token checks.