Content Spoofing and Local Redirect in Mapbox Studio

Summary

@hussain reported a content spoofing and local redirect issue in Mapbox Studio in February 2016. Strings passed to the message query string parameter on requests to https://www.mapbox.com/studio/forbidden/ would write text directly to the page.

@hussain combined the content spoofing issue with a redirect via the redirect query string parameter. We were not able to reproduce an open redirect, though a local redirect to other pages within Studio did exist. We were also not able to replicate the injection of CSS in Internet Explorer and Mozilla Firefox that @hussain reported.

Ordinarily we would not award a bounty for separate individual reports about content spoofing, social engineering, or local redirects, but we awarded the minimum bounty in this case due to the following factors:

• effective proof of concept that combined social engineering, content spoofing, and local redirect in a believable exploit
• relative ease of social engineering via sharing a URL
• change to our codebase and subsequent deployment