# Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow

Case-sensitive scheme check in app.hey.com/proxy_image 302s HTTPS:// URLs, letting a same-origin link redirect into an attacker page inside HEY desktop's chromeless window.

- Payout: not disclosed
- Severity: medium
- Program: Basecamp
- Credited: nasrysami
- Disclosed: 2026-10-15
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/3972760
- Library page: https://bugbountylibrary.com/r/h1%3A3972760
- Tags: domain:desktop domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:electron technique:chained technique:source-review vuln:auth-bypass vuln:open-redirect

**Target:** app.hey.com /proxy_image endpoint and HEY desktop Electron window allowlist
**Root cause:** proxy_image compares the URL scheme case-sensitively, so uppercase HTTPS:// is not recognized as proxyable and the endpoint 302s to the raw URL instead of signing it. The desktop app treats any same-origin app.hey.com URL ending in /print or .text as safe to load in a BrowserWindow.
**Steps:**
1. `curl -sI "https://app.hey.com/proxy_image/HTTPS%3A%2F%2Fexample.com%2F"` returns `302 location: HTTPS://example.com/`
2. Lowercase control `https%3A%2F%2Fexample.com%2F` returns a signed gopher.hey.com proxy URL
3. Send victim `https://app.hey.com/proxy_image/HTTPS%3A%2F%2Fexample.com%2F?x=/print` (percent-encode inner URL; suffix /print or .text satisfies desktop allowlist)
4. Victim clicks in HEY desktop; origin check passes (app.hey.com), /print suffix passes, createWindow loads URL, 302 lands on attacker origin inside chromeless window
**How found:** Noticed scheme comparison was case-sensitive by testing uppercase vs lowercase HTTPS; recognized that same-origin URLs pass the desktop allowlist and that a redirect after the check escapes it; also code-read stage.js isInternalAttachmentLink and the disposition=attachment guard.
**Exploitation:** Attacker emails a crafted app.hey.com link to a known address; one click in HEY desktop opens a chromeless HEY window rendering attacker content, enabling a fake HEY re-auth prompt to harvest credentials and full mailbox access.
**Escalation:** Chains a web-asset open redirect with the desktop app's same-origin trust to defeat the external-link guard; second same-root-cause location in inbound mail image rewriter noted but not exploitable due to CSP img-src.
**Insight:** When a desktop/Electron app trusts 'same origin' as 'safe to load in-app', hunt for any open redirect or scheme-parsing quirk on that origin (case, encoding, path suffix) that survives the allowlist check and then redirects off-origin.