# CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go public

XSRF token leaked in Vimeo's moogaloop 404 page, readable via crossdomain.xml and Cross-Site Flashing, enabling CSRF to make private videos public.

- Payout: hidden
- Severity: high
- Program: Vimeo
- Found by: opnsec
- Disclosed: 2016-07-29
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/136481
- Library page: https://bugbountylibrary.com/r/h1%3A136481
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high technique:chained technique:source-review vuln:csrf vuln:info-disclosure

**Target:** moogaloop.swf Flash player and vimeo.com/moogaloop 404 page
**Root cause:** The 404 page at vimeo.com/moogaloop embeds the user's XSRF token and private info; crossdomain.xml permits *.vimeocdn.com to read it, and moogaloop.swf is vulnerable to Cross-Site Flashing via the config_url flashvar, letting an attacker SWF read the token.
**Steps:**
1. Observe XSRF token and user info present in source of `https://vimeo.com/moogaloop` 404 page
2. Note `http://vimeo.com/moogaloop/crossdomain.xml` allows `*.vimeocdn.com` to read that page
3. Load `https://f.vimeocdn.com/p/flash/moogaloop/6.3.5/moogaloop.swf` from attacker SWF via Cross-Site Flashing (config_url flashvar)
4. Use moogaloop.swf's origin to fetch `https://vimeo.com/moogaloop` and read the XSRF token
5. Replay token in `POST https://vimeo.com/settings` (name change) and `POST https://vimeo.com/settings/videos` (privacy to public)
**How found:** Researcher noticed the XSRF token and private info rendered in the moogaloop 404 page source, then combined the permissive crossdomain.xml with a Cross-Site Flashing flaw in moogaloop.swf to read that page cross-origin.
**Exploitation:** Victim opens attacker page with Flash active and logged into Vimeo; evil.swf loads moogaloop.swf, takes control, reads the XSRF token from the 404 page, then issues authenticated CSRF POSTs to change the account name and set all current and future videos to public, also leaking name, user id and account type.
**Escalation:** Token theft converts a token-protected settings endpoint into a CSRF-able one, exposing private videos publicly and enabling further account changes.
**Insight:** Error/404 pages often still render session-bound tokens; check whether any crossdomain.xml or Flash/SWF gadget grants a trusted origin read access to those error pages, turning token leakage into full CSRF.