# Camo Image Proxy Bypass with CSS Escape Sequences

CSS hex escape in url() bypassed Chaturbate's camo image-proxy URL rewriting, letting profile owners force visitors to make arbitrary requests.

- Payout: hidden
- Severity: low
- Program: Chaturbate
- Found by: zhutyra
- Disclosed: 2019-12-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/745953
- Library page: https://bugbountylibrary.com/r/h1%3A745953
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:low technique:parser-differential vuln:info-disclosure vuln:misconfiguration vuln:ssrf

**Target:** Profile Bio HTML sanitizer / camo image proxy
**Root cause:** The sanitizer's CSS url() detector does not parse CSS escape sequences, so `u\72l(...)` is not recognized as a URL and is left unrewritten.
**Steps:**
1. Place `<span style="background:u\72l(http://foo.com/bar)">XX</span>` in About Me bio.
2. Save the profile edit.
3. Inspect element: URL is not replaced with camo.stream.highwebmedia.com proxy URL.
4. Observe in Network monitor the browser issues the request (blocked here by CSP).
**How found:** Noticed the sanitizer rewrites plain `url(...)` to the camo proxy, hypothesized the parser lacks CSS escape support, and tested hex-escaping a letter in `url`.
**Exploitation:** A room owner embeds the escaped url() in their bio; visitors' browsers parse the CSS escape and fetch the attacker-chosen URL directly, bypassing the proxy. CSP blocked the request in testing.
**Insight:** When a sanitizer rewrites CSS url() tokens, test CSS escape sequences (e.g. `u\72l`) and other equivalent encodings the regex/parser may not normalize before matching.