# Wordpress.com REST API oauth bypass via Cross Site Flashing

Permissive crossdomain.xml on public-api.wordpress.com plus Cross-Site Flashing on yimg.com let an attacker bypass the WordPress.com OAuth flow and gain full account authorization.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: opnsec
- Disclosed: 2018-04-26
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/176308
- Library page: https://bugbountylibrary.com/r/h1%3A176308
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:oauth technique:chained vuln:auth-bypass vuln:csrf

**Target:** public-api.wordpress.com crossdomain.xml and OAuth2 authorization flow
**Root cause:** crossdomain.xml on public-api.wordpress.com trusts *.yahoo.com and *.yimg.com, which host user-injectable Flash content; a malicious SWF on those domains can make credentialed cross-domain requests and read responses, including the OAuth flow.
**Steps:**
1. Ensure Flash is active and victim is logged into wordpress.com
2. Host malicious SWF on a yimg.com/yahoo.com user-content location
3. SWF issues cross-domain requests to https://public-api.wordpress.com/oauth2/ reading responses
4. Complete OAuth authorization flow on victim's behalf, granting attacker app 'OauthBypasss' full account access
5. Load POC http://opnsec.com/wp/hunger.html and wait 10-20s to observe the app gaining authorization
**How found:** Noticed crossdomain.xml allowed *.yahoo.com and *.yimg.com, recognized those domains host user-uploadable Flash content (Cross-Site Flashing), and reasoned that a SWF there could read OAuth responses.
**Exploitation:** Attacker embeds a Flash file on a domain trusted by crossdomain.xml (yimg.com), which then performs credentialed cross-origin requests to the WordPress.com OAuth endpoints and reads the responses, silently authorizing an attacker-controlled OAuth app against the victim's account.
**Insight:** Check crossdomain.xml/clientaccesspolicy.xml allowlists for domains that host user-uploaded Flash/SWF content; any such entry turns into a credentialed cross-origin read primitive against sensitive endpoints like OAuth flows.