# Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's host

Federalist API lacked CSRF protection; a Flash SWF plus 307 redirect forged the JSON Content-Type, letting an attacker trigger any POST action as a logged-in user.

- Payout: hidden
- Severity: medium
- Program: GSA Bounty
- Found by: sp1d3rs
- Disclosed: 2017-09-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/263662
- Library page: https://bugbountylibrary.com/r/h1%3A263662
- Tags: area:web domain:api domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:chained vuln:csrf

**Target:** Federalist REST API (v0 build/site endpoints)
**Root cause:** API accepted JSON POST requests with no anti-CSRF token; the JSON Content-Type check was assumed to block CSRF, but Flash can set arbitrary Content-Type and a 307 redirect preserves the POST body/headers to the target.
**Steps:**
1. Host a crafted SWF that POSTs JSON to an attacker PHP endpoint with Content-Type application/json.
2. PHP endpoint returns `307` redirect to the Federalist endpoint (e.g. `https://federalist.18f.gov/v0/build`), preserving method and body.
3. Victim (logged in, Flash enabled) visits page loading `test.swf?jsonData={"site":1,"branch":"master"}&php_url=...&endpoint=https://federalist.18f.gov/v0/build`.
4. SWF sends JSON to PHP, 307 redirects to Federalist, which processes the POST as the victim, e.g. restarting the build.
**How found:** Noticed Federalist API had no CSRF protection but initial PoC failed because JSON Content-Type was checked; after reading other researchers' articles on Flash Content-Type forgery and 307 redirects, realized Flash could forge the header and bypass the check.
**Exploitation:** Attacker lures a logged-in Federalist user to a page hosting the SWF; the SWF issues a JSON POST to an attacker PHP script that 307-redirects to the Federalist API, so the browser replays the POST with the forged Content-Type, executing any POST action the victim is authorized for (trigger build, add site if repo name known).
**Insight:** When a JSON API relies solely on Content-Type checking for CSRF defense, Flash (with crossdomain.xml and a 307 redirect) can forge the header and replay POSTs; test GET/POST separately since PUT/DELETE may be blocked.