# Permanent CASB Integration Takeover due to Improper Access Controls+Confused Deputy Problem

Cloudflare CASB failed to validate ownership of deleted Microsoft/GitHub/Box integrations, letting attackers re-add a victim's tenant UUID or installation_id and read their CASB findings.

- Payout: hidden
- Severity: high
- Program: Cloudflare Public Bug Bounty
- Found by: matured_kazama
- Disclosed: 2023-09-18
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2086301
- Library page: https://bugbountylibrary.com/r/h1%3A2086301
- Tags: area:cloud domain:cloud impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:oauth technique:recon vuln:access-control vuln:auth-bypass vuln:idor

**Target:** CASB third-party integration onboarding (Microsoft tenant, GitHub/Box installation_id)
**Root cause:** Backend did not validate that the tenant UUID/domain or installation_id being connected actually belonged to the requesting user, so a previously-deleted integration could be re-attached by anyone who knew its identifier.
**Steps:**
1. Enumerate or obtain a victim's Microsoft tenant UUID/domain or GitHub/Box installation_id from a previously connected-then-removed CASB integration.
2. Initiate a new CASB integration in attacker's own Cloudflare account using that identifier.
3. Backend accepts the identifier without ownership validation (confused deputy).
4. Integration is re-bound to attacker account, exposing CASB findings for the victim's integration.
**How found:** Researcher noted CASB backend lacked validation on integration identifiers and hypothesized that deleted integrations could be re-claimed by enumerating enterprise/tenant ids.
**Exploitation:** Attacker enumerates valid tenant UUIDs/domains or installation_ids of integrations a prior customer had connected and later deleted, then adds that same integration to their own account; CASB trusts the identifier and surfaces the victim integration's findings.
**Insight:** Deleted third-party integrations often leave orphaned identifiers; test whether re-adding a known tenant_id/installation_id re-binds prior data to a new account (confused deputy) rather than requiring fresh OAuth consent.