# URL Spoof / Brave Shield Bypass

Brave's legacy url.parse mis-parsed `brave.com%60x.code-fu.org`, so shield settings for brave.com were applied to an attacker-controlled domain.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: mattaustin
- Disclosed: 2017-08-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/255991
- Library page: https://bugbountylibrary.com/r/h1%3A255991
- Tags: area:os domain:browser impact:integrity kind:bounty platform:hackerone sev:high tech:nodejs technique:parser-differential vuln:access-control vuln:misconfiguration

**Target:** Browser URL parser / shield settings hostname matching
**Root cause:** Brave used Node's non-WHATWG url.parse, which treats `%60` as part of the path and reports host `brave.com`, while Chrome/the renderer parses host as `brave.com`x.code-fu.org`. Shield settings keyed on the mismatched hostname.
**Steps:**
1. Browse to `http://brave.com` and toggle the shield from up to down (per-site setting).
2. Browse to `http://brave.com%60x.code-fu.org/`.
3. Observe the shield is down for this attacker domain, inheriting brave.com's setting.
4. Compare `url.parse('http://brave.com%60x.code-fu.org/')` (host brave.com) vs `new url.URL(...)` (host brave.com`x.code-fu.org).
**How found:** Noticed shield state carried over to an unrelated domain; hypothesized a parser differential between the renderer and node's url.parse, then confirmed by comparing url.parse vs WHATWG url.URL output.
**Exploitation:** Attacker registers a domain and crafts a URL whose hostname begins with a victim domain plus an encoded backtick, so the browser loads the attacker site while Brave's node-side parser attributes it to the victim domain, inheriting that domain's shield/permission settings (e.g. enabling flash on a whitelisted domain).
**Insight:** When a browser/electron app keys per-site security settings on a hostname parsed in a different runtime (node) than the renderer, test encoded delimiters like `%60`, `%2f`, `%5c` that legacy url.parse folds into the path but WHATWG parsers keep in the host.