# Multiple so called 'type juggling' attacks. Most notably PhabricatorUser::validateCSRFToken() is 'bypassable' in certain cases.

PHP loose comparison in Phabricator CSRF, Conduit and Mailgun signature checks lets a token of "0" match magic-hash values, weakening CSRF protection.

- Payout: hidden
- Severity: medium
- Program: Phabricator
- Found by: superkritisch
- Disclosed: 2015-10-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/86022
- Library page: https://bugbountylibrary.com/r/h1%3A86022
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:auth-bypass vuln:crypto vuln:csrf

**Target:** PHP web application (CSRF token, Conduit API, Mailgun webhook signature checks)
**Root cause:** Loose == / != comparisons between user-supplied strings and hash outputs; PHP casts "0e..."-style hashes and the input "0" to equal floats.
**Steps:**
1. Identify loose comparisons: `if ($token == $valid)` in PhabricatorUser::validateCSRFToken(), `if ($valid != $signature)` in ConduitConnectConduitAPIMethod, and `hash_hmac('sha256', ...) == $sig` in MetaMTAMailgunReceiveController.
2. Note $valid/$digest are sha1/hmac outputs that occasionally take the form 0+[eE]\d+.
3. Supply `0` as the CSRF token / signature; when the server-side hash is a magic hash, the loose comparison returns true.
4. Confirm with PoC: sha1("AAJd1x3j")=="0" yields bool(true).
**How found:** Code review of Phabricator's hash comparison sites, applying known PHP type-juggling behavior to spot non-strict == / != operators on user-controlled strings.
**Exploitation:** Attacker submits token/signature value "0"; if the server-generated hash happens to be a magic hash (0e...), comparison passes, bypassing CSRF token check, Conduit certificate check, or Mailgun webhook signature verification.
**Insight:** Grep PHP codebases for `==`/`!=` comparing user input against hash_hmac/sha1/md5 output; magic-hash collisions turn these into auth/CSRF bypasses. Also check truncated substr comparisons.