# Flash Cross Domain Policy Bypass by Using File Upload and Redirection - only in Chrome

Flash FileReference upload in Chrome followed redirects and disclosed cross-origin response data via UPLOAD_COMPLETE_DATA, and 307/308 redirects re-sent uploads bypassing cross-domain policy.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: irsdl
- Disclosed: 2015-05-06
- CVE: CVE-2015-0337
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/51265
- Library page: https://bugbountylibrary.com/r/h1%3A51265
- Tags: area:os domain:browser impact:data-leak kind:bounty platform:hackerone sev:high tech:chromium technique:chained vuln:cors vuln:file-upload vuln:open-redirect

**Target:** Flash FileReference upload handling in Chrome
**Root cause:** Chrome's Flash FileReference upload followed HTTP redirects without re-checking the cross-domain policy, and dispatched the final response body to UPLOAD_COMPLETE_DATA; 307/308 redirects also replayed the upload body to the new origin.
**Steps:**
1. Host a SWF using FileReference.upload() pointing at an attacker-controlled open redirect URL.
2. Set the redirect target to the victim site (e.g. `https://plus.google.com/u/0/`) with status 301 to leak content, or 307/308 to replay the upload.
3. Load `http://attacker.com/chromeFileUploadCrossDomain.swf?url=redirect.php?input=https://plus.google.com/u/0/`.
4. Read the victim response from the UPLOAD_COMPLETE_DATA event.
**How found:** Observed that FileReference uploads follow redirects and that UPLOAD_COMPLETE_DATA exposes the final response, then tested redirect status codes to see which preserved the request body.
**Exploitation:** Attacker lures victim to a page hosting the SWF; the SWF uploads to an open redirect that 301s to the target site, and Chrome's Flash plugin returns the target's response body to the SWF via UPLOAD_COMPLETE_DATA, enabling cross-origin reads. With 307/308 the upload body is forwarded to the target without policy check.
**Insight:** Upload APIs that follow redirects and surface the final response body are a cross-origin read primitive; test 301 vs 307/308 redirects separately since they differ in whether the body is replayed and whether policy is re-checked.