# OAuth access_token stealing in Phabricator

Phabricator's Facebook OAuth redirect_uri accepted a user-controlled blog custom domain, leaking victim Facebook access tokens to an attacker server.

- Payout: $450
- Severity: high
- Program: Phabricator
- Credited: krangbuster
- Disclosed: 2014-04-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3596
- Library page: https://bugbountylibrary.com/r/h1%3A3596
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:oauth technique:chained vuln:auth-bypass vuln:open-redirect

**Target:** Facebook OAuth login flow via Phabricator (Phame blog custom domain)
**Root cause:** Phabricator's OAuth redirect_uri validation allowed a redirect to a Phame blog's attacker-controlled custom domain, so the Facebook token was delivered to the attacker's server.
**Steps:**
1. Create a Phame blog at `https://secure.phabricator.com/phame/blog/new/` with custom domain `files.nirgoldshlager.com`
2. Send victim `https://www.facebook.com/dialog/oauth?client_id=184510521580034&response_type=token&redirect_uri=https://secure.phabricator.com/phame/live/47/`
3. Victim clicks Continue; Facebook redirects with `#access_token=...` to the Phabricator blog URL
4. Phabricator serves the blog on the custom domain, so the fragment/token is sent to `files.nirgoldshlager.com` and logged
**How found:** Noticed Phabricator lets users attach arbitrary custom domains to Phame blogs, and that the Facebook OAuth redirect_uri could point at such a blog path, turning it into an open redirect that leaks the token fragment.
**Exploitation:** Attacker registers a Phame blog with a custom domain they control, then crafts a Facebook OAuth implicit-flow URL whose redirect_uri points at the blog. Victim authorizes, Facebook appends the access_token to the redirect, and the attacker's custom domain captures it.
**Insight:** When a platform lets users bind custom domains to hosted content, any OAuth redirect_uri pointing at that content becomes attacker-controlled; test whether token-bearing fragments/params land on the user's domain.