# Change contents of the careers iframe in https://corp.badoo.com/jobs

Newline between dots bypassed the '..' filter on the careers iframe's p parameter, letting an attacker load their own Jobvite account content inside corp.badoo.com for phishing.

- Payout: hidden
- Severity: medium
- Program: Bumble
- Found by: zombiehelp54
- Disclosed: 2016-07-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/147776
- Library page: https://bugbountylibrary.com/r/h1%3A147776
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:parser-differential vuln:path-traversal

**Target:** corp.badoo.com/jobs iframe p parameter
**Root cause:** The p parameter is concatenated into the Jobvite iframe URL; the filter only rejects literal '..' but a newline (%0A) between the dots survives the check and is normalized to a traversal by the downstream URL handling.
**Steps:**
1. Visit `https://corp.badoo.com/jobs/?p=` and observe the iframe src is `https://jobs.jobvite.com/badoo/<p>`.
2. Note that `p=../something` is blocked because the code checks for double dots and falls back to the base URL.
3. Send `https://corp.badoo.com/jobs/?jkl&p=.%0A./jobvite` to bypass the check and load another Jobvite account's jobs.
4. Create a Jobvite account and craft `https://corp.badoo.com/jobs/?jkl&p=.%0A./<handle>` or `.../job/o0PBZfw9/apply` to render attacker-controlled content/form inside the trusted page.
**How found:** Noticed the p parameter controls the iframe path, tried `../` and saw it blocked by a double-dot check, then hypothesized the check was a naive string match and tried inserting a newline between the dots to evade it.
**Exploitation:** Attacker registers a Jobvite account, builds a job listing or application form with phishing fields, and sends victims a corp.badoo.com link whose p parameter traverses to their account, so victims submit names, emails, phones, images or passwords believing they are on Badoo's careers page.
**Insight:** When a filter blocks the literal '..' string, try inserting encoded control characters (newline, tab, null) between the dots; the check sees no '..' but the URL parser or downstream server normalizes it back into a traversal.