CVE-2015-1885

CVE-2015-1885 affects IBM WebSphere Application Server: vulnerable when OAuth password grant is used. Affects WebSphere Application Server Full/Profile: 8.5 (Liberty 8.5) up to 8.5.5.x, 8.0 up to 8.0.0.10, and 7.0 up to 7.0.0.38/39. Root cause: OAuth ear (WebSphereOauth20SP.ear) handling allows p...

Shopify: Open redirection in OAuth

Hello, When we specify an invalid scope then the authorize url redirects to the site mentioned in redirecturi. So, attacker can create an app and use it as open redirector to redirect victims to fake sites. eg. Attacker can host same phishing page and hack the victims. Proof Of Concept :...

Open redirect in rfc6749 aka 'The OAuth 2.0 Authorization Framework'

!Image result for meme all the...

Internet Bug Bounty: Race Conditions in OAuth 2 API implementations

Most of OAuth 2 API implementations seem to have multiple Race Condition vulnerabilities for processing requests for Access Token or Refresh Token. Race Condition allows a malicious application to obtain several accesstoken and refreshtoken pairs while only one pair should be generated. Further, ...

Synology.com Cross Site Scripting

Exploit Title: Synology.com sub-domain OAuth exchange Reflected XSS RXSS Date: 03/04/2014 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.synology.com Version: / Category: Reflected Cross Site Scripting Google dork: Tested on: Synology.com update sub-domain Synology description ...

Dropbox SDK for Android account spoofing

It's possible to spoof account via OAuth...

Android DropBox SDK Vulnerability, CVE-2 0 1 4-8 8 8 9 analysis-vulnerability warning-the black bar safety net

Today, personal data are stored in the cloud, which makes it like a photo backup or General storage as service can not only be accessed by the user, can also be representative of the user of the app the access. In many ways, including access to the control functions of the app and the service...

The Dropbox SDK, there is a remote exploit, has been an emergency fix-bug warning-the black bar safety net

! The Dropbox developers recently fixed the Android version of the Dropbox SDK to store the application on a remote exploitation vulnerability, an attacker exploit the vulnerability without user consent directly to the app and the Dropbox account is connected. As long as the user installed...

OAuth Hacks A gentle introduction to OAuth 2 and Apache Oltu

Here I posted the slides of the JUG event in Basel. I have been kind of quiet lately in this space. I have a couple on vulnerabilities outstanding one OAuth related and one browser related. Waiting for the green light... stay tuned...

Dropbox Patches Remotely Exploitable Vulnerability in SDK

Developers at Dropbox recently fixed a remotely exploitable vulnerability in the Android SDK version of the storage app that enabled attackers to connect applications to a Dropbox account without the user’s consent. This could have opened users up to the theft of information from any app that use...

Design/Logic Flaw

The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding opt parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scop...

CVE-2014-7922

The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding opt parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scop...

CVE-2014-7922

CVE-2014-7922 involves the GoogleAuthUtil.getToken method in the Google Play services SDK prior to 2015. The vulnerability arises when the code sets parameters in OAuth token requests after detecting a corresponding opt parameter in the Bundle extras argument, enabling a crafted application to by...

CVE-2014-7922

The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding opt parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scop...

Coinbase: open authentication bug

Hi, If developer registers one of the three url's with out http protocol ex:example.com in oauth registration then he would be redirected to www.coinbase.comexample.com.This makes the user to redirect to another site than the real application.Attacker could take advantage of this and steal the...

X (Formerly Twitter): Problem with OAuth

There are many website that tracks the unfollowers and all like: http://unfollowerstats.com Steps: 1. Login with ur twitter account, i.e. [email protected] 2. Open http://unfollowerstats.com, This will ask you to login with twitter: 3. you will get a link like this:...

X (Formerly Twitter): Flaw in login with twitter to steal Oauth tokens

Hey hi, Steps to reproduce: ============================================= I have been testing the twitter kit in fabric. I added login with twitter integration to my application. I pushed the application to my android phone , clicked login with twitter. entered my username and password. Searched ...

Vimeo: unvalid open authentication with facebook

Hi, vimeo site is using facebook for open authentication . The authentication url is in this way https://www.facebook.com/dialog/oauth?clientid=19884028963&redirecturi=https://vimeo.com/facebook/join?ssl=0&iframe=0&popup=0&player=0&productid=0&scope=email,basicinfo,readstream,publishactions&state...

Top 5 OAuth 2 Implementation Vulnerabilities

Heya, back to my favourite topics namely OAuth . I have previously discussed about common OAuth 2 Implementation Vulnerabilities but now it is time maybe to list those and order them based on their criticality. 5 The Postman Always Rings Twice I have introduced this 'attack' in last year post...

Moonpig API Vulnerability Exposes Payment Card Data

Moonpig, a U.K.-based company that sells personalized greeting cards, mugs, t-shirts and other novelties, has been taken to the woodshed for poor security practices by a researcher who claims it’s simple to pilfer user and payment card data through a wonky mobile app API. The company this morning...