# Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session

HackerOne's zendesk_session return_to accepted a Zendesk redirect_to_account URL, chaining to an attacker Zendesk account and bypassing the interstitial warning to reach evil.com.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: zombiehelp54
- Disclosed: 2016-02-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/111968
- Library page: https://bugbountylibrary.com/r/h1%3A111968
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:chained vuln:open-redirect

**Target:** hackerone.com/zendesk_session endpoint with return_to parameter
**Root cause:** The return_to parameter was trusted to point at hackerone.com/support.hackerone.com, but the Zendesk /ping/redirect_to_account endpoint on that trusted host forwards to an arbitrary attacker-controlled Zendesk account, which then redirects off-site without an interstitial.
**Steps:**
1. Craft URL `https://hackerone.com/zendesk_session?locale_id=1&return_to=https://support.hackerone.com/ping/redirect_to_account?state=compayn:/`
2. Create a custom Zendesk account whose state/redirect target is an untrusted site (evil.com)
3. Victim clicks the link; hackerone.com treats the return_to host as trusted and forwards to the Zendesk redirect_to_account endpoint
4. Zendesk redirects between accounts without interstitial, landing the victim on evil.com with no warning
**How found:** Researcher revisited a prior Zendesk open-redirect report (#101146) that Zendesk declined to fix, reasoning that HackerOne's interstitial trust decision could be defeated by routing through the trusted support.hackerone.com Zendesk redirect endpoint.
**Exploitation:** Attacker registers a Zendesk account configured to redirect to an untrusted site, then supplies its /redirect_to_account?state= URL as the return_to of hackerone.com/zendesk_session. Because the host is trusted and Zendesk skips the interstitial for inter-account redirects, the victim is silently sent to the attacker's site.
**Insight:** When a program trusts a hostname to decide whether to show an interstitial, look for any endpoint on that trusted host (e.g. Zendesk /ping/redirect_to_account) that itself forwards to attacker-controlled destinations; the trust check only inspects the host, not the downstream redirect.