7248 matches found
Reddit: Oauth Misconfiguration Lead To Account Takeover
Summary: OAuth is a commonly used authorization framework that enables websites and web applications to request limited access to a user's account on another application. Crucially, OAuth allows the user to grant this access without exposing their login credentials to the requesting application...
Redirect URL matching ignores character casing
Impact Before version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using strings.ToLower while they should have been compared with a simple string match: 1. Registering a client with allowed redirect URL...
GHSA-GRFP-Q2MM-HFP6 Redirect URL matching ignores character casing
Impact Before version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using strings.ToLower while they should have been compared with a simple string match: 1. Registering a client with allowed redirect URL...
mod_auth_openidc:2.3 bug fix update
An update is available for modauthopenidc, cjose. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an OpenID Connect authentication module f...
8x8: Subdomain takeover of ████.jitsi.net
Summary █████.jitsi.net points to an AWS EC2 instance at 18.195.93.116 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing ...
Autobinding vulnerability in MITREid Connect
org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...
Authorization service vulnerable to DDos attacks in Apache CFX
CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from...
GHSA-7Q4H-PJ78-J7VG Authorization service vulnerable to DDos attacks in Apache CFX
CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from...
Code Injection
Overview oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid...
Zego: Subdomain takeover of v.zego.com
Summary v.zego.com points to an AWS EC2 instance at 52.214.138.192 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing to...
SaaS Attacks: Lessons from Real-Life Misconfiguration Exploits
It’s unfortunate but true: SaaS attacks continue to increase. You can’t get around it, COVID-19 accelerated the already exploding SaaS market and caused industries not planning on making a switch to embrace SaaS. With SaaS apps becoming the default system of record for organizations, it has left...
Improper Certificate Validation in oauth ruby gem
lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information...
GHSA-7359-3C6R-HFC2 Improper Certificate Validation in oauth ruby gem
lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information...
CVE-2021-31555
An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarcversion aka oauthregisteredconsumer.oarcversion parameter's length...
CVE-2021-31555
An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarcversion aka oauthregisteredconsumer.oarcversion parameter's length...
Design/Logic Flaw
An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarcversion aka oauthregisteredconsumer.oarcversion parameter's length...
CVE-2021-31555
An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarcversion aka oauthregisteredconsumer.oarcversion parameter's length...
CVE-2021-31555
CVE-2021-31555 concerns the MediaWiki Oauth extension (up to version 1.35.2) failing to validate the length of the oarc_version parameter (oauth_registered_consumer.oarc_version). The issue is described as a weakness in input validation within the Oauth extension; no public fix/version or remedia...
