# Possible SOP bypass in www.starbucks.com due to insecure crossdomain.xml

Starbucks crossdomain.xml trusted a wildcard subdomain whose parent had a takeover-vulnerable subdomain, letting a Flash file read authenticated responses.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: jackb898
- Disclosed: 2017-09-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/244504
- Library page: https://bugbountylibrary.com/r/h1%3A244504
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:high technique:chained technique:recon vuln:cors vuln:misconfiguration vuln:subdomain-takeover

**Target:** crossdomain.xml / Flash cross-domain policy on www.starbucks.com
**Root cause:** crossdomain.xml granted access to wildcard subdomains (e.g. `*███████`) and allowed any request headers (`<allow-http-request-headers-from domain="*" headers="*"/>`); one such domain had a dangling subdomain vulnerable to takeover, so an attacker-controlled Flash file could issue and read cross-origin requests to starbucks.com.
**Steps:**
1. Fetch `https://www.starbucks.com/crossdomain.xml` and note entries like `<allow-access-from domain="*███████" />` and `<allow-http-request-headers-from domain="*" headers="*" />`
2. Enumerate subdomains of each wildcard-allowed domain
3. Find `m███████` under `███████.com` is vulnerable to subdomain takeover
4. Take over `m███████` and host a malicious Flash (SWF) file there
5. Flash file sends HTTP requests to starbucks.com and reads responses, bypassing SOP
**How found:** Read crossdomain.xml, noticed many wildcard-domain entries rather than a single `*`, then enumerated subdomains of each allowed domain looking for takeover candidates.
**Exploitation:** Attacker takes over the dangling subdomain, hosts a Flash SWF, and lures a logged-in Starbucks user to it; the SWF issues cross-origin requests to starbucks.com with arbitrary headers and reads the responses, exfiltrating sensitive authenticated data.
**Escalation:** Wildcard header allowance (`headers="*"`) removes header restrictions, widening what requests the Flash file can forge.
**Insight:** Cross-domain policy files are an attack surface: any wildcard-trusted domain is only as secure as its weakest subdomain, so pair crossdomain.xml review with subdomain-takeover enumeration of every listed domain.