# Bypassing Digits bridge origin validation

Digits bridge iframe validated the host param but not the embedding page origin, letting any site fetch victims' OAuth credentials and hijack accounts.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2017-04-30
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/110467
- Library page: https://bugbountylibrary.com/r/h1%3A110467
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:oauth technique:source-review vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** Digits Web SDK bridge iframe (https://www.digits.com/bridge) and /login_status endpoint
**Root cause:** The bridge validates that the host parameter matches the app's registered domain, but never checks that the page embedding the bridge iframe actually originates from that domain, so any attacker page can embed the bridge with the legit host value.
**Steps:**
1. Observe Digits.getLoginStatus() injects iframe `https://www.digits.com/bridge?consumer_key=<key>&host=<origin>` and communicates via postMessage.
2. Note `/bridge?consumer_key=9I4iINIyd0R01qEPEwT9IC6RE&host=https://www.periscope.tv` passes validation while host=https://attacker.com fails.
3. Attacker embeds the passing bridge URL (with legit host) in their own page and sends the getLoginStatus command via postMessage.
4. Bridge makes AJAX to /login_status and returns victim's OAuth credential data via postMessage to the attacker's parent window.
5. Use stolen credentials to log into victim's account (PoC renamed Periscope account to 'Pwn3d').
**How found:** Reading the Web SDK docs, the researcher noticed getLoginStatus uses a postMessage bridge iframe with a host parameter, then tested that host validation exists but reasoned the embedding page origin was unchecked.
**Exploitation:** Attacker page embeds the bridge iframe with the victim app's consumer_key and registered host, issues getLoginStatus via postMessage, receives the OAuth credential data, and uses it to authenticate as the victim. No user interaction required beyond the victim having previously authorized the app in Digits.
**Escalation:** Can be embedded in a player card for stealthy mass delivery since no interaction is needed.
**Insight:** When a postMessage bridge validates a URL parameter against a registered domain, check whether it also validates the actual embedding frame's origin — parameter validation alone is bypassable by embedding the trusted URL yourself.