# Limited CSRF bypass.

Path traversal in HackerOne's report_id parameter let a GET request reach the Slack OAuth callback, bypassing CSRF token enforcement to forge integration requests.

- Payout: $500
- Severity: medium
- Program: HackerOne
- Credited: defmax
- Disclosed: 2015-12-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/99708
- Library page: https://bugbountylibrary.com/r/h1%3A99708
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:oauth technique:chained vuln:auth-bypass vuln:csrf vuln:path-traversal

**Target:** hackerone.com /bugs report_id parameter and /auth/slack/callback
**Root cause:** report_id is concatenated into an XHR URL without integer validation, allowing ../../../ traversal to arbitrary same-origin GET endpoints; those endpoints (OAuth callbacks) don't enforce CSRF tokens on GET.
**Steps:**
1. Observe /bugs?report_id=99698 triggers XHR GET /reports/99698.json
2. Append %3F to report_id to escape the .json suffix: report_id=99698%3F yields /reports/99698?.json
3. Traverse with report_id=..%2F..%2F..%2F99698%3F to reach /99698?.json
4. Target /auth/slack/callback with url-encoded code/state plus fake param `asd=` so the trailing .json lands on the dummy param
5. Submit GET form to https://hackerone.com/bugs with report_id=../../../auth/slack/callback?code%3D...%26state%3D...%26asd%3D
6. Server issues 302 to /anontest5667/integrations confirming the callback executed without CSRF token
**How found:** Noticed report_id loads report JSON via XHR; probed with trailing ? to see how the .json suffix is appended, then used ../ traversal to escape the reports directory and reach other same-origin GET endpoints.
**Exploitation:** Attacker hosts an auto-submitting GET form to /bugs; the victim's browser follows the traversal to the Slack OAuth callback, completing integration without a valid CSRF token. Full takeover blocked because Slack state parameter validation could not be bypassed.
**Escalation:** Theory: bypassing OAuth state validation on any integration would let attacker attach their own Slack workspace and take over the team.
**Insight:** When a parameter is concatenated into an XHR URL with a forced suffix like .json, a trailing %3F plus a dummy param relocates the suffix, and ../ traversal turns the XHR into a same-origin GET primitive that skips CSRF token checks on OAuth callbacks.