# crossdomain.xml too permissive on eu1.badoo.com, us1.badoo.com, etc.

Permissive crossdomain.xml on badoo.com allowed attacker-uploaded Flash files on static-*.badoo.com to read authenticated user data cross-origin.

- Payout: hidden
- Severity: medium
- Program: Bumble
- Found by: stefanovettorazzi
- Disclosed: 2017-08-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/96662
- Library page: https://bugbountylibrary.com/r/h1%3A96662
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:medium tech:cdn vuln:access-control vuln:file-upload vuln:misconfiguration

**Target:** crossdomain.xml / Flash cross-origin policy on badoo.com subdomains
**Root cause:** crossdomain.xml uses wildcard `<allow-access-from domain="*.badoo.com"/>`, and user-uploaded files are served from static-*.badoo.com, so attacker-controlled Flash content inherits trust to read authenticated endpoints.
**Steps:**
1. Upload a malicious Flash file (bug.jpg) via https://us1.badoo.com/feedback/ attachment.
2. Retrieve the support email link and extract the static-*.badoo.com file URL with signature from the img src.
3. Set the `<embed>` src in bug.html to that static URL.
4. Serve bug.html locally (`php -S 0.0.0.0:8000`) and open it while logged into Badoo.
5. Flash loads from static-*.badoo.com, permitted by crossdomain.xml, and reads https://us1.badoo.com/settings into a textarea.
**How found:** Noticed the wildcard allow-access-from in crossdomain.xml and that user-uploaded files land on static-*.badoo.com, a domain matching the wildcard.
**Exploitation:** Attacker uploads a Flash payload as a support attachment, gets it hosted on static-*.badoo.com, then embeds it from an attacker page. Because crossdomain.xml trusts *.badoo.com, the Flash can make credentialed requests to us1.badoo.com and read/update the victim's data (e.g. /settings).
**Insight:** When a wildcard crossdomain.xml trusts *.domain.com, check whether any subdomain hosts user-uploaded content (attachments, avatars, static CDNs) — that turns file upload into a cross-origin read primitive via Flash.