# Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome

CSRF in webapp.starbucks.co.jp leaked an access token for authenticated users on non-Chrome browsers lacking default SameSite, and could add a Starbucks card.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: elber
- Disclosed: 2021-05-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1113559
- Library page: https://bugbountylibrary.com/r/h1%3A1113559
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high technique:chained vuln:csrf

**Target:** webapp.starbucks.co.jp / login.starbucks.co.jp web application
**Root cause:** State-changing endpoints lacked CSRF protection; cookies lacked SameSite enforcement in browsers other than Chrome, so a crafted HTML file could trigger authenticated cross-site requests.
**Steps:**
1. Authenticate a victim user in webapp.starbucks.co.jp on a non-Chrome browser (no default SameSite).
2. Deliver a crafted HTML file that issues cross-site requests to the vulnerable endpoints.
3. Victim opens the file; the request executes with the victim's cookies, leaking the access token.
4. A second crafted HTML file adds a Starbucks card to the victim's account.
**Exploitation:** Attacker tricks an authenticated user into opening a crafted HTML file in a non-Chrome browser; the resulting cross-site requests carry the victim's cookies, leaking an access token and allowing a Starbucks card to be added, with potential single-account takeover at login.starbucks.co.jp.
**Escalation:** Chained token leak and card-add primitive toward account takeover at login.starbucks.co.jp.
**Insight:** Browser-dependent SameSite defaults create CSRF exposure: endpoints that appear protected in Chrome remain exploitable in browsers that don't default cookies to SameSite, so test state-changing flows across browsers.