# Incorrect param parsing in Digits web authentication

Digits web auth parsed query params with & only while server also split on ;, letting host validation be bypassed to redirect OAuth credentials to attacker domain.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2018-08-18
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/126522
- Library page: https://bugbountylibrary.com/r/h1%3A126522
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:oauth technique:parser-differential vuln:auth-bypass vuln:open-redirect

**Target:** OAuth web authentication popup flow (popup.js)
**Root cause:** Client-side popup.js splits query string only on '&' while the server also treats ';' as a delimiter, so the two sides disagree on the value of the host parameter.
**Steps:**
1. Observe popup.js parses `window.location.search.slice(1).split("&")` then splits each on `=`.
2. Note server accepts `;` as param delimiter: `?consumer_key=X;host=https%3A%2F%2Fwww.periscope.tv` equals `&host=...`.
3. Craft `https://www.digits.com/login?consumer_key=9I4iINIyd0R01qEPEwT9IC6RE&host=https%3A%2F%2Fwww.periscope.tv;@attacker.com`.
4. Server validates host as `https://www.periscope.tv`; client parses host as `https://www.periscope.tv;@attacker.com` whose authority is attacker.com.
5. Victim completes phone login; OAuth credential data is sent to attacker-controlled domain.
**How found:** Compared client-side query parsing in popup.js against server-side delimiter handling, noticing the client assumed only '&' while the server also accepted ';', creating a parser differential on the host parameter.
**Exploitation:** Attacker lures victim through a crafted Digits login URL; after phone-number login the popup posts OAuth credentials to the attacker-controlled host parsed client-side, and the PoC renames the victim's Periscope account to 'Pwn3d'.
**Insight:** When a client and server both parse the same URL, test alternate delimiters (';') and userinfo tricks (';@host') to make each side see a different authority for the same parameter.