# CSRF on Periscope Web OAuth authorization endpoint

Periscope Web OAuth authorize endpoint lacked CSRF token or Origin validation, letting a malicious app silently obtain an authorization code and full API access to a victim's account.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2017-07-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/215381
- Library page: https://bugbountylibrary.com/r/h1%3A215381
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:oauth technique:source-review vuln:auth-bypass vuln:csrf

**Target:** OAuth authorization endpoint (POST /oauthAuthorize) on www.periscope.tv
**Root cause:** The /oauthAuthorize endpoint accepted cross-site form POSTs without a CSRF token or Origin/Referer validation, so a third-party app could force a logged-in victim to approve its client_id.
**Steps:**
1. Victim is logged into periscope.tv (sid cookie present).
2. Attacker page auto-submits `POST https://www.periscope.tv/oauthAuthorize` with body `client_id=████&redirect_uri=https%3A%2F%2Fgetmevo.com%2Foauth%2Fperiscope?abc`.
3. Browser sends victim's sid cookie; no CSRF token or Origin check blocks it.
4. Server redirects to redirect_uri with `?code=abcde&state=`, leaking the authorization code to the attacker's app.
5. Attacker exchanges code at `https://public-api.periscope.tv/v1/oauth/token` for an access_token.
6. Attacker calls `/v1/broadcast/create`, `/v1/broadcast/publish`, `/v1/broadcast/delete` with the token.
**How found:** Noticed the authorize POST carried only the session cookie with no CSRF token or Origin validation, then tested a cross-site form submission to confirm the code was issued to an attacker-controlled redirect_uri.
**Exploitation:** Attacker hosts a page that cross-site POSTs to /oauthAuthorize with their client_id and redirect_uri; the victim's session cookie authorizes the app, the code lands on the attacker's redirect_uri, is swapped for an access token, and used to create/publish/delete broadcasts and tweet them.
**Insight:** OAuth authorize endpoints are state-changing POSTs tied to the session cookie; check them for CSRF tokens and Origin/Referer validation, since a missing check converts a login CSRF into full API token theft via the attacker's redirect_uri.