# CSRF on launchpad.37signals.com OAuth2 authorization endpoint

OAuth2 authorization endpoint on launchpad.37signals.com skipped CSRF token check when using .json/.xml format, letting a malicious app silently obtain an authorization code and full API access.

- Payout: hidden
- Severity: high
- Program: Basecamp
- Found by: carbon61
- Disclosed: 2020-10-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/850022
- Library page: https://bugbountylibrary.com/r/h1%3A850022
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:oauth technique:source-review vuln:auth-bypass vuln:csrf

**Target:** OAuth2 authorization endpoint (launchpad.37signals.com/authorization)
**Root cause:** The authorization endpoint enforces the authenticity token only for HTML responses; requesting the .json/.xml format bypasses the CSRF check, so a cross-site POST is accepted.
**Steps:**
1. Register an OAuth app on the 37Signals Integration Portal to get client_id, client_secret, redirect_uri.
2. Log the victim into a 37Signals product (e.g. Basecamp 3) that uses OAuth2.
3. Serve a form POSTing to `https://launchpad.37signals.com/authorization.json` with `client_id`, `type=web_server`, `redirect_uri`, `commit=`.
4. Victim's browser submits it; server returns redirect to redirect_uri with `code` without validating authenticity token.
5. Exchange the code at `POST /authorization/token` with `type=web_server&client_id=...&redirect_uri=...&client_secret=...&code=...` to get an access token.
6. Use token for full API access to victim's account.
**How found:** Researcher noticed the authorization endpoint validated the authenticity token for normal HTML requests but not when the `.json`/`.xml` format suffix was appended, indicating a format-dependent CSRF check bypass.
**Exploitation:** Attacker registers an OAuth app, then lures a logged-in victim to a page that auto-submits a cross-site POST to the .json authorization endpoint. Because the CSRF token check is skipped for the JSON format, the server issues an authorization code to the attacker's redirect_uri, which the attacker exchanges for an access token granting full API access.
**Insight:** When a state-changing endpoint supports multiple response formats, test each format suffix (.json, .xml) for CSRF token enforcement—frameworks often skip protection on non-HTML renderers.