# [CRITICAL] Full account takeover using CSRF

CSRF token rt leaked in a public service-worker JS file let an attacker link their social account to a victim's Badoo account, enabling full account takeover.

- Payout: hidden
- Severity: critical
- Program: Bumble
- Found by: zombiehelp54
- Disclosed: 2016-04-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/127703
- Library page: https://bugbountylibrary.com/r/h1%3A127703
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:critical tech:oauth technique:js-analysis technique:source-review vuln:account-takeover vuln:csrf

**Target:** OAuth social-account linking endpoint (google/verify.phtml) and chrome-service-worker.js
**Root cause:** The CSRF-protecting rt parameter is embedded in a publicly fetchable service-worker JS file (url_stats variable), so any site can read it cross-origin via a script tag and replay it against the social-link verify endpoint.
**Steps:**
1. Observe that linking Gmail redirects to `https://eu1.badoo.com/google/verify.phtml?rt=<state>&code=<code>` and only `rt` guards CSRF.
2. Notice `rt` appears in many JSON responses; find it leaked in `https://eu1.badoo.com/worker-scope/chrome-service-worker.js` as `var url_stats = 'https://eu1.badoo.com/chrome-push-stats?ws=1&rt=<rt_param_value>';`.
3. Load that JS via `<script src=https://eu1.badoo.com/worker-scope/chrome-service-worker.js?ws=1>` on attacker page to read `url_stats`.
4. Extract rt with `str.split('=')[2]` and redirect victim to `https://eu1.badoo.com/google/verify.phtml?code=<attacker_code>&...&rt=<csrf_code>`.
5. Attacker's Gmail is now linked to victim account; log in via that social account to take over.
**How found:** Noticed rt is the sole CSRF defense and appears in many JSON responses, then hunted for a cross-origin-readable leak and found it embedded in a public service-worker JS file.
**Exploitation:** Attacker hosts a page that includes the service-worker JS as a script (leaking rt), extracts the token, then navigates the victim to the verify.phtml URL with the attacker's OAuth code and the victim's rt, binding the attacker's social identity to the victim account for later login.
**Escalation:** Linking any social account grants persistent login to the victim's account, yielding full account takeover.
**Insight:** When a CSRF token appears in many responses, grep public static assets (service workers, JS bundles, stats endpoints) for it—cross-origin script inclusion of a JS file that embeds the token defeats the protection.