# Flash CSRF: Update Ad Frequency %: [cp-ng.pinion.gg]

Flash-based CSRF using a 307 redirect bypasses JSON content-type restrictions to update a Unikrn user's ad frequency setting via a POST endpoint.

- Payout: hidden
- Severity: medium
- Program: Unikrn
- Found by: geekboy
- Disclosed: 2017-09-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/251918
- Library page: https://bugbountylibrary.com/r/h1%3A251918
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest vuln:csrf

**Target:** Ad frequency update endpoint on cp-ng.pinion.gg
**Root cause:** The endpoint accepted JSON POST requests without CSRF protection, and Flash's crossdomain/307 redirect trick allowed sending a JSON body cross-origin, bypassing the content-type restriction that normally blocks simple-form CSRF.
**Steps:**
1. Log in at `https://cp-ng.pinion.gg`
2. Visit `http://geekboy.ninja/poc/freq.swf`
3. Flash issues a POST with JSON body to the ad frequency endpoint via a 307 redirect, which preserves method and body
4. Ad Frequency % is updated for the victim's userid (userid is in the endpoint and modifiable)
**How found:** Researcher recognized the endpoint required JSON content-type, which blocks classic form CSRF, and used Flash plus a 307 redirect to force a JSON POST cross-origin.
**Exploitation:** Attacker hosts a malicious SWF; when a logged-in victim loads it, Flash sends a cross-origin POST with a JSON content-type to the ad frequency endpoint using a 307 redirect to preserve the method/body, updating the victim's setting without a token.
**Insight:** When an endpoint rejects form-encoded CSRF because it requires application/json, Flash (with crossdomain.xml permitting) plus a 307 redirect can still deliver a JSON body cross-origin — check legacy Flash/redirect tricks against JSON-only endpoints lacking CSRF tokens.