Top 5 OAuth 2 Implementation Vulnerabilities

2015-01-06T16:14:00
ID INTOTHESYMMETRY:23DD2BCD974EACE24225B95A69B3E501
Type intothesymmetry
Reporter Antonio Sanso (noreply@blogger.com)
Modified 2015-06-08T14:41:45

Description

Heya, back to my favourite topics namely OAuth .
I have previously discussed about common OAuth 2 Implementation Vulnerabilities but now it is time (maybe) to list those and order them based on their criticality.

#5 The Postman Always Rings Twice

I have introduced this 'attack' in last year post . This is for provider implementer, it is not extremely severe but, hey, is better to follow the spec. Specifically

The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code.

It turned out that even Facebook and Google did it wrong... :)

#4 Match Point

To all OAuth Providers be sure to follow section 4.1.3 of the spec in particular

...if the "redirect_uri" parameter was included in the initial authorization request as described in Section 4.1.1, and if included ensure that their values are identical.

Should you fail to do it, this in combination with Lassie Come Home below is game over (even for implementer that support only the Authorization Code Grant flow).

#3 Crossing The Line

As per any other website part is important to not forget Cross Site Request Forgery aka CSRF protection in your OAuth provider impelemtation. Some examples are:

#2 The Devil Wears Prada

If you are an OAuth client that use OAuth for authentication (do NOT). If you absolutely have to, you'd better read User Authentication with OAuth 2.0 . Specially if you are using the OAuth Implicit Grant flow (aka Client side).
More about the topic in here and here

#1 Lassie Come Home

....and the winner is _'Lassie Come Home'. _Well this is hell of a danger.
There are way too many example of provider vulnerable to this attack. Just listing few here:

  • Egor Homakov hacking Github
  • me/myself hacking Facebook bypassing the regex redirect_uri validation
  • me/myself breaking the Google/Github integration At least the mitigation for this issue is damn simple: use exact matching against registered redirect uri to validate the redirect_uri parameter