# Cloudflare CASB Confused Deputy Problem

Cloudflare CASB trusted client-supplied GitHub installation_id or Microsoft tenant as OAuth code, letting attackers create integrations for other customers' orgs and read their CASB findings.

- Payout: $3,300
- Severity: critical
- Program: Cloudflare
- Credited: albertspedersen
- Disclosed: 2023-06-07
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1952124
- Library page: https://bugbountylibrary.com/r/h1%3A1952124
- Tags: domain:cloud domain:web3 impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:critical tech:oauth technique:js-analysis technique:source-review vuln:access-control vuln:auth-bypass vuln:idor

**Target:** Cloudflare Zero Trust CASB integration creation API (/casb/integrations)
**Root cause:** The integration-creation endpoint used the client-supplied credentials.code (GitHub installation_id or Microsoft tenant) as the OAuth authorization proof without verifying the caller actually owned that installation/tenant, and allowed multiple integrations pointing to the same tenant.
**Steps:**
1. Authorize Cloudflare CASB GitHub app to own org; observe callback URL with `installation_id` and POST to `/accounts/<acc>/casb/integrations` with `credentials.code` set to the installation_id.
2. Read dashboard JS `getCode()`: GITHUB uses `installation_id`, MICROSOFT_INTERNAL uses `tenant`, others use `code`.
3. Replay POST with another account's `installation_id` (incrementing integer, ~36M range) to create an integration for their org.
4. For Microsoft, POST `credentials.code` set to target domain (e.g. `example.com`) or tenant UUID; tenant UUID obtainable from `https://login.microsoftonline.com/<domain>/.well-known/openid-configuration`.
5. Observe victim's CASB findings (repo names, 2FA-disabled member names/emails, SharePoint links) appear in attacker dashboard.
**How found:** Noticed the dashboard sent GitHub installation_id instead of the OAuth code in credentials.code, hypothesized the server trusted it blindly, and confirmed by replaying the request with a friend's installation_id; then read dashboard JS to find the Microsoft tenant path.
**Exploitation:** Attacker enumerates GitHub installation_ids (sequential integers) or Microsoft domains/tenant UUIDs, then POSTs to the CASB integrations API with the victim's identifier as credentials.code, creating a rogue integration that surfaces the victim org's CASB findings in the attacker's Cloudflare dashboard.
**Escalation:** Enumerate top 10,000 Microsoft domains or all GitHub installation IDs to mass-target CASB customers; findings leak employee names/emails useful for further account takeover.
**Insight:** When an OAuth callback posts a credential field, compare it against the actual OAuth code from the URL — a mismatch (installation_id/tenant instead of code) signals the server may trust an enumerable identifier. Read the dashboard JS switch on vendor to find alternate identifier paths per integration type.