# Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com

Missing origin check on HackerOne's Marketo postMessage listener lets an attacker race a forged success message and redirect victims to a data: URL in Safari.

- Payout: hidden
- Severity: low
- Program: HackerOne
- Found by: fransrosen
- Disclosed: 2019-04-05
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/381356
- Library page: https://bugbountylibrary.com/r/h1%3A381356
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:low tech:payment technique:race-window technique:source-review vuln:business-logic vuln:open-redirect vuln:race-condition

**Target:** Marketo form postMessage listener on www.hackerone.com
**Root cause:** The Marketo form listener on www.hackerone.com does not validate the origin of incoming postMessages, and when a form lacks an onSuccess handler (or returns true), the attacker-controlled followUpUrl is passed directly to location.href without validation.
**Steps:**
1. Open malicious page that calls `window.open('https://www.hackerone.com/product/response#contact','b','_blank')` to load a form without onSuccess (mktoForm_1013).
2. Repeatedly `b.postMessage('{"mktoResponse":{"for":"mktoFormMessage0","error":false,"data":{"formId":"1013","followUpUrl":"data:text/html;base64,..."}}}','*')` every 10ms to race the legit Marketo response.
3. Victim fills and submits the contact form; attacker message wins the race before Marketo's ajax round-trip completes.
4. Listener passes followUpUrl to location.href; in Safari top-navigation to data: is allowed, rendering a fake HackerOne sign-in page that exfiltrates credentials.
**How found:** Prior report #207042 established Marketo postMessage lacked origin checks. Re-examining the listener, the researcher noticed followUpUrl is passed to location.href when onSuccess is absent/returns true, then searched the site JS for forms (mktoForm_1013) lacking onSuccess and tested browser behavior for data: top-navigation.
**Exploitation:** Attacker lures victim to a malicious page that opens the HackerOne contact form in a new window and floods postMessages containing a forged success response with a data: URL followUpUrl. When the victim submits the form, the attacker's message beats Marketo's legitimate response, and the listener navigates the top frame to the attacker's data: page (Safari only), a pixel-perfect fake login that captures credentials.
**Escalation:** Chained with Safari's allowance of top-level data: navigation to convert an open-redirect-like primitive into a credential-phishing page; noted that without CSP it would be XSS, and other Marketo customers lacking CSP are likely affected.
**Insight:** When a third-party widget uses postMessage without origin checks, look for a race window between the widget's async backend call and the listener, and hunt for config variants (forms without onSuccess) that turn a benign field like followUpUrl into a navigation sink; test data:/javascript: top-navigation per browser since CSP and browser differences gate impact.