# Insecure redirect rule results in bypassing ban redirect on certain pages

Unanchored ban-redirect whitelist rule plus ASP.NET path-after-extension handling let banned Roblox accounts reach .aspx/.ashx pages and APIs, defeating bans.

- Payout: hidden
- Severity: medium
- Program: Roblox
- Found by: b62ba6bd20eb778df2a0691
- Disclosed: 2020-04-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/703058
- Library page: https://bugbountylibrary.com/r/h1%3A703058
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:dotnet vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** *.roblox.com ban redirect rules and ASP.NET endpoints
**Root cause:** The ban redirect whitelist rule `/*/membership/*` is not anchored, and ASP.NET ignores path segments appended after `.aspx`/`.ashx`, so appending `/membership/` after the extension skips the ban redirect.
**Steps:**
1. Observe banned accounts are redirected to a ban page except for whitelisted URL patterns.
2. Note whitelist includes `https://www.roblox.com/*/membership/*` (unanchored) and any URL ending in a file extension except .aspx/.ashx.
3. Append `/membership/` after an .aspx/.ashx path, e.g. `https://www.roblox.com/my/money.aspx/membership/`.
4. Server ignores the trailing segment and serves the page without the ban redirect.
**How found:** Enumerated the ban-redirect whitelist rules, noticed `/*/membership/*` was not anchored, and combined it with knowledge that ASP.NET ignores path segments after .aspx/.ashx extensions.
**Exploitation:** A banned user appends `/membership/` to any .aspx/.ashx endpoint (e.g. `https://data.roblox.com/Data/Upload.ashx`, `https://www.roblox.com/API/Comments.ashx`, `https://www.roblox.com/Trade/tradehandler.ashx`) to create/update assets, post comments, and trade despite the ban. Separately, api.roblox.com accepted banned authenticated sessions with no check at all.
**Escalation:** Bypass applies to all .aspx/.ashx pages and APIs, making bans broadly ineffective; api.roblox.com additionally lacked any ban check.
**Insight:** When a redirect/blocklist uses glob patterns, check anchoring: a mid-path wildcard like `/*/membership/*` can be satisfied by appending the segment to any URL. Pair with framework quirks (ASP.NET path-after-extension) to reach blocked endpoints.