# HTTP MitM on Flash Player settings manager allows attacker to set sandbox settings

Flash Player settings manager served over HTTP let a network MitM write the local settings cookie, granting permanent webcam/mic and CORS exemptions.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: staatseigendom
- Disclosed: 2018-12-23
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/54094
- Library page: https://bugbountylibrary.com/r/h1%3A54094
- Tags: area:os domain:browser domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:high vuln:info-disclosure vuln:misconfiguration

**Target:** Flash Player settings manager (settings.swf / local settings cookie)
**Root cause:** The settings manager SWF was reachable over plain HTTP at the same path as the HTTPS version, and Flash wrote the local settings cookie from that HTTP response without requiring HTTPS.
**Steps:**
1. Position attacker on victim's network path (MITM).
2. Serve an altered settings SWF over HTTP at the settings manager path (no HTTPS/cert needed), e.g. via MITMProxy.
3. Victim loads the SWF (embedded in attacker site or injected into HTTP traffic).
4. Altered SWF writes local settings cookie: permanent webcam/mic access, CORS exemption, or auto-update interval ~9999 days.
**How found:** Observation that the HTTPS-only settings manager could still be reached over HTTP at the same path and that Flash accepted the HTTP-served SWF to write the local settings cookie.
**Exploitation:** Attacker with network access serves a modified settings SWF over HTTP; Flash stores the resulting local settings cookie, persistently granting camera/microphone access, disabling CORS restrictions, or disabling auto-update for the target domain.
**Escalation:** Persistence via local settings cookie survives beyond the MitM session; auto-update disable keeps NPAPI Flash vulnerable.
**Insight:** When a security-sensitive config UI is HTTPS-only, check whether the same resource path is also served/consumed over HTTP and whether the client persists state from the HTTP response.