# Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone

CSRF token not validated in HackerOne's Tray.io integration auth flow allowed linking victim's GitHub to attacker's account, enabling private repo access.

- Payout: hidden
- Severity: high
- Program: HackerOne
- Found by: medmahmoudi
- Disclosed: 2023-06-19
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1727221
- Library page: https://bugbountylibrary.com/r/h1%3A1727221
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:graphql tech:oauth vuln:csrf

**Target:** OAuth2 authorization endpoint (hackerone.integration-authentication.com)
**Root cause:** The OAuth2 authorization endpoint did not properly validate the CSRF token, allowing an attacker to reuse a valid session and CSRF token to initiate an authorization flow that binds the victim's third-party account to the attacker's HackerOne account.
**Steps:**
1. Attacker creates a HackerOne program and starts GitHub integration setup.
2. Attacker captures the GET request to `https://hackerone.integration-authentication.com/oauth2/auth/<Auth ID>?csrf=<token>&scope=read:org%20repo&session=<session>`.
3. Attacker sends this URL to the victim.
4. Victim clicks the link; if already authorized, GitHub redirects to callback without consent; otherwise victim may authorize.
5. Attacker changes the authentication window location to `https://hackerone.integration-configuration.com/auth/cb?id=<Auth ID>` to complete the flow.
6. Victim's GitHub account is now linked to attacker's HackerOne account.
**How found:** Researcher analyzed the OAuth flow and noticed that step 2 (authorization link generation) lacked proper CSRF protection, allowing reuse of a valid session and CSRF token.
**Exploitation:** Attacker lures victim to click a crafted OAuth authorization URL. The victim's GitHub account gets linked to the attacker's HackerOne integration. Attacker then uses Tray.io's GraphQL API with the obtained authId to make arbitrary API calls to GitHub, such as fetching private repositories via `callConnector` mutation.
**Escalation:** Attacker can prepare multiple exploit links for different integrations and open them in separate windows with one user click, compromising multiple integrations simultaneously.
**Insight:** When testing OAuth integrations, check if the authorization endpoint validates the CSRF token against the user's session; if the token is static or not bound to the session, it may be reusable for CSRF.