oauth misconfiguration to account takeover

Save my name, email, and website in this browser for the next time I comment. An attacker can take over the victims account and compromise the system. JSON Web Token Misconfiguration Leads to Account Takeover. when I saw this request I felt something interesting here because there is no state parameter, which means some time it may be vulnerable to csrf attack. OAuth authentication vulnerabilities arise partly because the OAuth specification is relatively vague and flexible by design. Now start the Reconnaissance using some tools. in the token. This article has helped you understand OAuth Vulnerabilities. Your email address will not be published. Most of the web and mobile applications these days use OAuth to secure their authorization endpoints. Let's call it - https://victim.com. But it is not actually computing signature and validating that. It also represents the type of the token, like JWT. So, the attacker also having access to that account. The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". Required fields are marked *. After so many months, I am back with a writeup for an interesting vulnerability i found in RedBull two days ago,but it was duplicate. 2023, ZOFixer. Hi Every one, My name is Yasser (AKA Neroli in CTFs) and I wanted to share this Finding with you :), Since its a private program on Bugcrowd i will call it example.com. Properly verify the signature of the incoming token on the server side. Now open poc.html page in the browser and click on submit button, Facebook account is successfully linked with victim account on https://www.redacted.com, Logout from the application and try to login from your social account, Successfully logged into the victim account of. By doing so, it is possible to remove the attackers persistence.Read More. This is the simple one and very easy to exploit. First, clearly verify the Email OTP or link, then give the access to the dashboard. Admin panel publicly accessible. JWTs are used for a variety of purposes, including authentication and authorization. Your email address will not be published. The header typically contains information about the algorithm used to sign the token and the type of token it is (e.g., JWT). When I saw this option i just open Burpsuite and clicked the Facebook icon for linking my account to Facebook and intercept the request and response. Lets look at the website https://www.redacted.com, so the website looks like a normal site,nothing interesting in homepage so I go to the Signup page and got a page like shown below. Dont report the bug if you didnt tried your best. Learn how your comment data is processed. 1. So when the server receives the token, it can verify the tokens signature based on the kid parameter to map and verify it with the correct key. In the case of OAuth, missing state parameter could result in an account takeover. Generally, the account takeover via OAuth functionality occurs due to weak implementation of redirect_uri. The header in JWT will define which algorithm is used while signing the token. What is OAuth Misconfiguration - Account Takeover vulnerability Victim Account Take Over. It does not store any personal data. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices. Observe that the server accepts the modified token. Its me Jackson. dont be random and try to understand what is happening not just reading a lot of write-ups and do as same as the write-ups says. Any Settings can be changed by an attacker and, if the website has any premium or payment details that leads to leakage of sensitive information. Critically Sensitive Data - Password Disclosure. Now you have access to the victims account through email id and password you set. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc. I was able to do and reported the same to example.com. Enable the issuing server to revoke the tokens on log out and after a particular amount of time. This is how their CSP looked when viewed on Google's CSP Evaluator -, The unsafe-inline mostly does the trick in terms of inline script execution so that's not an issue.This could also have been bypassed using https://www.gstatic.com domain shown above because it hosts Angular Libraries. May you all be well on your side of the screen. A flaw in the OAuth flow allows for the takeover of the victims account. Use the JWT editor to inspect and modify the header. It is the industry-standard protocol for authorization. Learn how your comment data is processed. Lets check who does it affect? This cookie is set by GDPR Cookie Consent plugin. P2 Vulnerability -Account takeover using OAuth Misconfiguration There's a limitation that requires a validated email before going through the oauth flow, however this is bypassable. Leave a clap and follow for more updates. The JWT vulnerability is present in many platforms and applications, including your company. Whenever an OAuth authentication is being used, the first thought crossing the mind of an attacker is to check if the application validates the value of redirectUrl. The security is almost entirely dependent on developers using the proper configuration settings and trying to implement additional safeguards, such as a robust authentication mechanism. OAuth 2.0 is a Web Application Authorization Framework. For example https://www.readcted.com/ is the application. OAuth 2.0 is widely used by applications (such as SaaS platforms) to access data that is already available on the Internet. Therefore, the security of any JWT-based mechanism relies heavily on the cryptographic signature, which verifies the authenticity of the JSON Web Token. Create an account with the victim's email address. If the signature is invalid, the JWT should be considered untrusted and not used. *. Jan 20, 2019 -- 4 Hello guys. 6. An open protocol to allow secure authorization in a simple and standard method from web, mobile, and desktop applications. https://example/oauthCallBack?code={code}&cid={id, https://javascript.info/cross-window-communication, https://vinothkumar.me/20000-facebook-dom-xss/, https://opnsec.com/2020/05/dom-xss-in-gmail-with-a-little-help-from-chrome/, https://portswigger.net/web-security/oauth. Pre-Account Takeover using OAuth Misconfiguration - Medium I quickly fired burp and entered 1000 payloads to see if there was any rate limiting and if OTP could be brute forced. P2 Vulnerability -Account takeover using OAuth Misconfiguration, Vulnerability Category: A6- Security Misconfiguration. List: account takeover | Curated by RainOfDelight | Medium After registering and logging in, the server will assign a Session Token in JSON Web Token Format. Since, Attacker and victim end same account was used on. Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet. OAuth is an open-standard authorization protocol or framework that describes how unrelated servers and services can safely allow authenticated access to their assets without actually sharing the initial, related, single logon credential. These cookies ensure basic functionalities and security features of the website, anonymously. so I guess that this what is solving the problem. Analytical cookies are used to understand how visitors interact with the website. In authentication parlance, this is known as secure, third-party, user-agent, delegated authorization. Avoid using redirects and forwards based on user-provided input. SaaS platforms) to access your data that is already on the Internet. If user input cant be avoided, ensure that the supplied value is valid, appropriate for the application, and is authorized for the user. This website uses cookies to improve your experience while you navigate through the website. Required fields are marked *. The payload in the JWT is data transferred to the server or used as user identification. Some will only accept the exact same redirect_uri path as specified in the client application, but some will accept anything in the same domain or subdirectory of the redirect_url. JWT vulnerability can affect any organization or individual using JWT (JSON Web Token) as an authentication method. An attacker gives himself high privileges on the system or an application that is not given to regular users, like admin privileges. I found that the target allows users to log in using either a classic, password-based mechanism or by linking their account to a social media profile using OAuth. It is important to note that vulnerabilities can arise on both the client application and the OAuth service. These errors occur when the token content is incorrectly set leading to security issues such as unauthorized access to services. *. Login Request will be something like :. Lets check it out. Attacker can use a victim account whenever he wants. Description: OAuth-based vulnerability is when the configuration of the OAuth service itself enables attackers to steal authorization associated with other users' accounts. If no validation or extra method controls are used to validate the certainty of the URL, the code below is vulnerable to an attack. *. .css-284b2x{margin-right:0.5rem;height:1.25rem;width:1.25rem;fill:currentColor;opacity:0.75;}.css-xsn927{margin-right:0.5rem;height:1.25rem;width:1.25rem;fill:currentColor;opacity:0.75;}5 min read. On inspecting closely, it was observed that after returning from the OAuth flow, it sent a request to https://app.victim.com/auth/return containing the state and token values in the POST body.The interesting part was the response as a result of this request. This process involves using a cryptographic algorithm to create a hash of the header and payload, which is then encrypted using the secret key. and as u can see, no csrf token, In this case if the application fails to use the csrf token , an attacker could potentially hijack a victim user's account on the client application by binding it to their own social media account. There's a limitation that requires a validated email before going through the oauth flow, however this is bypassable . They are often used in modern web applications to transmit information between the client and the server securely. A flaw in the OAuth flow allows for the takeover of the victim's account. Check for the Token Randomness b. Implement JSON Web Token properly so the server cannot accept the JWT with no algorithm. OAuth Misconfiguration - Findings OAuth 2.0 is widely used by applications (e.g. I started looking for bugs in OAuth implementation and quickly found that the state parameter was missing. Here's how that would have looked -. OAuth, which stands for Open Authorization Framework, is the industry-standard authorization delegation protocol. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. The cookie is used to store the user consent for the cookies in the category "Performance". You can use the JWT editor Burp Suite extension. Implement the following to mitigate or fix the vulnerability: The blog addresses the essential issue with OAuth 2.0 misconfiguration: the general need for built-in security features. We are committed to ensuring the highest level of cybersecurity for our website visitors, so you can browse and shop with peace of mind. Further, by ensuring that the social logins are correctly implemented, the email extracted from the social login is verified against the existing users database to ensure that the victim asked to reset the password. 2. and after pressing accept the SDK is loading and the flaw start. OAuth Misconfiguration Leads to Pre Account Takeover GET /v3.1/dialog/oauth?response_type=code&redirect_uri=https%3A%2F%2Fredacted.com%2Fauth%2Ffacebook%2Fcallback&scope=email%2Cpublic_profile&client_id=00000000000 HTTP/1.1Host: www.facebook.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: https://redacted.com/profileCookie: fr=0rqajcCy4gEh2nJvS.redactedPv2OYVcelE.AWVp7-tG; sb=OQwFXNTRCDFUcookieLIw0; datr=OQwFXBW2scookieSe4q; wd=1366XXXXX657; locale=en_GB; c_uConnection: close. It validates the identity of a user to the website which requested it without disclosing passwords to the website. In some cases, the server may also encrypt the resulting hash to add an additional layer of security. Use long secrets that are hard to brute force or guess. Your email address will not be published. Necessary cookies are absolutely essential for the website to function properly. Oauth Misconfiguration lead to complete account takeover Feb 13, 2021 -- 2 Hi Every one, My name is Yasser (AKA Neroli in CTF's) and I wanted to share this Finding with you :) Since its a private program on Bugcrowd i will call it example.com Let's start Critically Sensitive Data - Private API Keys. OAuth Account Takeover | Pentest Vulnerability Wiki - Cobalt Nvd - Cve-2022-1631 Most security vulnerabilities arise due to incorrect implementation by the developer. An attacker can exploit this misconfiguration to generate or forge the Modifies Access token, which can lead to an Account takeover of any user by manipulating the token. 4. Your email address will not be published. This was a usual Project Management Web Application, using Microsoft's OAuth 2.0 to authorize their users to allow them access to the application. This includes XMLHttpRequest (XHR / AJAX), WebSocket, fetch(), or EventSource.https://content-security-policy.com/connect-src/, I tried frames and images as well but that didn't work either because of frame-src and image-src attributes -, If you are not allowed to connect to any external host, you can send data directly in the URL (query string) by redirecting the user to your web server. The claims can be encoded as a JSON object and used in a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure. Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features. Ensure to test all possible test cases for JSON Web Token misconfiguration, such as Lack of encryption, weak secret key, lack of expiration, lack of validation, lack of rate limiting, Lack of input validation, and lack of proper error handling before implementing the JWTs to avoid vulnerabilities towards these attacks. Now change that to the victims username, like an administrator. It can also potentially affect end users who rely on the security provided by JWT in their interactions with an affected organization or system. The website example.com used Twitter, Facebook, Google and Apple Oauth to sign in. *. at this point I gaved up and created a shitty click-jacking page that the user first needs to click on the link button then i redirect him to the Oauth link. My Name Is Yasser and I am a CTF player and Competitive programmer, I Love to build things then break into it. Unknowingly, the Victim will create an account through the Google OAuth functionality. so the impact is it does not authenticate the real user attackers can easily take over the account. The thing that troubled me was the data ex-filtration because the connect-src directive only allowed certain domains to make connections to.In simple terms, this means I can't randomly make requests to my own server to receive the tokens. Thats the issue and it shows the Account Takeover. We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. However, you may visit "Cookie Settings" to provide a controlled consent. SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5ci. In essence, OAuth provides developers an authorization mechanism to allow an application to access data or perform certain actions against your account from another application (the authorization server). Account Takeover and Persistence due to the Oauth Misconfiguration I found that the example.com had a Sign-up method by using. Sometimes they need to complete the development in a short time, so they have not checked for security in deep, and sometimes, the developer doesnt know much about security vulnerabilities. The redirect_uri is important because sensitive data, such as the code, is appended to this URL after authorization. [Case Study] OAuth Misconfiguration leads to Account Takeover If the redirect_url can be redirected to an attacker-controlled server, this means the attacker can potentially take over a victims account by using the code themselves and gaining access to the victims data. After installing Burp Suite, you need to install an extension called JWT Editor. The connect-src Content Security Policy (CSP) directive guards the several browsers mechanisms that can fetch HTTP Requests. If the victim has admin-level privileges, it leads to sensitive information disclosure in the organization. Either dont let the user enter with Oauth when theres already another account created with the same email or let the user enter but let him know someone else has already created an account and if it was him or not then ask him to change the password. If the victim then tries to register or sign in with a third party, such as Google, the application may do a lookup, see that email is already registered, then link their Google account to the attacker-created account. I was successfully authenticated to Facebook, then i intercept the callback from Facebook.when i saw the callback, i wonderedthere is no state parameter which means there is no protection from a csrf attack, so lets exploit that. A JSON Web Token (JWT) is made up of 3 parts. This cookie is set by GDPR Cookie Consent plugin. This means users can fine-tune which data they want to share rather than having to hand over full. You change the payload like here, the sub is the username. Impact: An attacker can take over the account of the victim, CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. Simply avoid using redirects and forwards. Account takeover via "Forgot your password" functionality. Thank you all for reading and I hope you find it useful. If the application does not require email verification on account creation, try creating an account with a victims email address and the attackers password before the victim has registered. *. First thing i opened burp and started to log the requests and just start clicking on buttons, and after linking my profile I started looking at the request history I found the callback request. When used in a JWE structure, the claims can be encrypted for privacy. See how I found an OAuth misconfiguration escalated to pre authentication account takeover without Burpsuite or any other tool. In this case, you should have a method to validate URL. Vulnerability in OAuth flow leads to takeover of victim account . When I saw this callback,I just made a csrf html page called attack.html. Use Burp Suite, an all-in-one tool for penetration testing. Integrating third party OAuth providers are often left misconfigured by developers which may lead to a bigger security impact such as account takeover. For bugs related to the Pocket API and getpocket.com website, OAuth Misconfiguration Leads to Pre Account Takeover, after signing up or creating an account log out. 3. It gives an attacker the ability to . If user input is unavoidable, ensure that the supplied value is valid, appropriate for the application, and authorized for the user. Which shows attacker end attacker can login through the victim email address and password, victim end victim can login through the Google Oauth SSO. The security team appreciated the finding, and they announced $100 USD as the bounty amount. The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. *. In authentication parlance, this is known as secure, third-party, user-agent, delegated authorization. Lets start with aquatone -subdomain enumeration tool, so after running that tool I got some sub-domains,ran some tools like Lazyrecon, eyewitness, nmap, dirsearch, Advanced google dorks, wappalyzer ,some scripts and tools so now we got a target website. The claims in a JWT are contained in the payload and are a set of name-value pairs that convey information about an entity, such as the user or system. Without knowing the servers secret signing key, generating the correct signature for a given header or payload should not be possible. The cookie is used to store the user consent for the cookies in the category "Other. If you were ever asked by web or mobile application to give permissions to access your personal data, you have probably used OAuth 2.0. These cookies will be stored in your browser only with your consent. I have created a video demonstration of the vulnerability and uploaded it to my Google Drive. If used, do not allow the URL as user input for the destination by implementing a method to validate the URL. This is the value from the redirectUrl parameter shown earlier in the initial request. Account Takeover and Persistence due to the Oauth Misconfiguration Discription ## Team, May you all be well on your side of the screen. It verifies a user's identity to the website that requested it without giving passwords to the website. OAuth Misconfiguration Leads to Full Account takeover
Manufacturing Employee Experience, Why Is Seed Cleaning Illegal, Intex Schlauchboot 2 Personen, Articles O