Top 10 OAuth 2 Implementation Vulnerabilities

Some time ago I posted a blogpost abut Top 5 OAuth 2 Implementation Vulnerabilities. This week I have extended the list while presenting Top X OAuth 2 Hacks at OWASP Switzerland. This blog post like the presentation is just a collection of interesting attack OAuth related. 10 The Postman Always...

Shopify: CSRF in Connecting Pinterest Account

Hi, The connect to Pinterest function is vulnerable to CSRF. This allows an attacker to connect his/her pinterest account to the victim's shopify. Even if the victim has already connected a pinterest account, this will allow the attacker to replace the existing connected pinterest account with th...

oauth.mts.ru XSS vulnerability

Vulnerable URL: https://oauth.mts.ru/social-2.0/buttons.jsp?goto=https%3A%2F%2Fihelper.mts.ru%3A443%2Fselfcare%2Fproduct-2-view.aspx...

CentOS 7 : rest (CESA-2015:2237)

Updated rest packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CV...

rest security update

CentOS Errata and Security Advisory CESA-2015:2237 Updated rest packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

[SECURITY] Fedora 23 Update: python-rauth-0.7.2-1.fc23

A simple Python OAuth 1.0/a, OAuth 2.0, and Ofly consumer library built...

Coinbase: Stored-XSS in https://www.coinbase.com/

Coinbase was mistakenly allowing developers to set their website or developer URL to a javascript:// or data:// URL. This link would then be rendered into the OAuth authorization page and leave users vulnerable to XSS if they clicked on it...

Shopify: CSV Excel Macro Injection Vulnerability in export list of current users - app.shopify.com

Hi , I have found that when a user tries to Export list of current users who installed his apps through: https://app.shopify.com/services/partners/apiclients//exportinstalledusers the fields of the CSV file are not properly escaped. which makes them vulnerable to CSV Excel Macro Injection...

RHEL 7 : rest (RHSA-2015:2237)

Updated rest packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CV...

Low: Red Hat Security Advisory: rest security update

Updated rest packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CV...

HackerOne: Limited CSRF bypass.

Hello team I have found an very limited CSRF which could be valid for GET requests only. And the Integrations Tab is can be used in bypass Description : Effected url :-...

MediaWiki Oauth extension security bypass vulnerability (CNVD-2015-07398)

MediaWiki is a suite of free and freely available web-based wiki engines that can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in the MediaWiki Oauth extension, which allows remote attackers to exploit the vulnerability to bypass...

MediaWiki Oauth extension security bypass vulnerability (CNVD-2015-07397)

MediaWiki is a suite of free and freely available web-based wiki engines that can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in the MediaWiki Oauth extension, which allows remote attackers to exploit the vulnerability to bypass...

On (OAuth) token hijacks for fun and profit part #2 (Microsoft/xxx integration)

In a previous blogpost we have already analyzed a token hijack on one OAuth integration between some Microsoft and Google service and seen what went wrong. Now it is time to see yet another integration between Microsoft and xxxx unluckily I can't disclose the name of the other company due the fac...

Microsoft Pays $24,000 Bounty to Hacker for Finding 'Account Hacking' Technique

A security researcher has won $24,000 from Microsoft for finding a critical flaw in its Live.com authentication system that could allow hackers to gain access to a user’s complete Outlook account or other Microsoft services. Microsoft's Live.com is the authentication system that everyone go throu...

Apple Safari URI spoofing (CVE-2015-5764)

tl;dr Apple Safari for OS X was prone to URI spoofing vulnerability and more general a user interface spoofing. Apple released security updates for Safari 9 on OS X and assigned CVE-2015-5764. Accidentally this vulnerability was also present in iOS. Instant demo In Safari up to 8.0.8 : go to clic...

Jasig CAS 4.0.1 Cross Site Scripting

Jasig CAS server version 4.0.1 is prone to xss vulnerabilities Timeline: 20.02.2015 - Vendor notified 11.05.2015 - Patches released 21.09.2015 - Bugtraq disclosure Vulnerable version: 4.0.1 Fixed version: 4.0.2 Vulnerabilities details: 1 XSS in OpenID server Obtain method: Paste thi url...

New OAuth book: OAuth 2 in Action

Justin Richer and myself have been writing a book about OAuth. It gives a deep look at the OAuth 2.0 protocol including hands on examples and practical implementation vulnerabilities to avoid. You can preorder the book today or you can download the first chapter for free on the publisher’s websit...

Coinbase: OAUTH pemission set as true= lead to authorize malicious application

OAuth authorize button in the Coinbase Android App did not have the android:filterTouchesWhenObscured attribute set to true, which may have made it vulnerable to tap-jacking. Reported UI Redressing Clickjacking For Mobile application of Coinbase , attack scenario is same as...

X (Formerly Twitter): XSS on OAuth authorize/authenticate endpoint

Hi, I would like to report an issue where certain endpoints on twitter.com and api.twitter.com is vulnerable to XSS. Detail The redirection page after authorization/authentication does not sanitize the oauthcallback parameter. PoC 1. Go to http://innerht.ml/pocs/twitter-oauth-xss Please use IE or...