# OAuth 2 Authorization Bypass via CSRF and Cross Site Flashing

Overly permissive crossdomain.xml on api.vimeo.com/oauth let a malicious SWF read the OAuth authorize page and steal the token, granting full app access without user approval.

- Payout: hidden
- Severity: high
- Program: Vimeo
- Found by: opnsec
- Disclosed: 2017-10-18
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/136582
- Library page: https://bugbountylibrary.com/r/h1%3A136582
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:source-review vuln:auth-bypass vuln:csrf vuln:info-disclosure

**Target:** OAuth 2 authorization endpoint (api.vimeo.com/oauth/authorize)
**Root cause:** api.vimeo.com/oauth/crossdomain.xml sets allow-access-from domain="*", and Flash URL policy files apply to the directory and all child directories, so the authorize endpoint inheriting that policy becomes readable cross-domain.
**Steps:**
1. Victim logged into Vimeo with Flash active opens attacker page hosting evil.swf
2. evil.swf calls `Security.loadPolicyFile("https://api.vimeo.com/oauth/crossdomain.xml")`
3. evil.swf then loads `https://api.vimeo.com/oauth/authorize`; Flash accepts the parent policy file and skips the stricter authorize/crossdomain.xml
4. Attacker reads the authorize response source, extracting the OAuth token
5. Attacker completes authorization flow via redirect, adding 'OAuthBypass' app to victim's authorized apps
**How found:** Noticed the oauth/crossdomain.xml wildcard policy and reasoned from Adobe's documented rule that a URL policy file applies to its directory and child directories, then realized explicitly loading the parent policy file bypasses the stricter child crossdomain.xml.
**Exploitation:** Attacker lures logged-in victim to a page with a malicious SWF; the SWF loads the permissive parent policy file, reads the authorize endpoint cross-domain, steals the token, and completes the OAuth flow to gain full app privileges over the victim account without consent.
**Insight:** When a wildcard crossdomain.xml sits in a parent directory, any sensitive endpoint in a child directory inherits it; explicitly calling Security.loadPolicyFile on the parent overrides the child's stricter policy, so check directory hierarchy of Flash policy files around OAuth/token endpoints.