New OAuth book: OAuth 2 in Action

Justin Richer and myself have been writing a book about OAuth. It gives a deep look at the OAuth 2.0 protocol including hands on examples and practical implementation vulnerabilities to avoid. You can preorder the book today or you can download the first chapter for free on the publisher’s websit...

Coinbase: OAUTH pemission set as true= lead to authorize malicious application

OAuth authorize button in the Coinbase Android App did not have the android:filterTouchesWhenObscured attribute set to true, which may have made it vulnerable to tap-jacking. Reported UI Redressing Clickjacking For Mobile application of Coinbase , attack scenario is same as...

X (Formerly Twitter): XSS on OAuth authorize/authenticate endpoint

Hi, I would like to report an issue where certain endpoints on twitter.com and api.twitter.com is vulnerable to XSS. Detail The redirection page after authorization/authentication does not sanitize the oauthcallback parameter. PoC 1. Go to http://innerht.ml/pocs/twitter-oauth-xss Please use IE or...

WordPress WP OAuth Server Plugin Predictable Random Number Generation Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . WP OAuth Server is one of the plug-ins used to create and manage the OAuth2.0 server . A predictable random number...

python-oauth2: Uses poor PRNG in nonce

It was found that python-oauth2 did not properly generate random values for use in nonces. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...

WP OAuth Server <= 3.1.4 - Insecure Pseudor&om Number Generation

The WP OAuth Server OAuth Authentication WordPress plugin was affected by an Insecure Pseudor Number Generation security vulnerability...

Accellion FTA getStatus verify_oauth_token Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Accellion FTA getStatus verifyoauthtoken Command Execution', 'Description' = %q This module exploits a metacharacter shell injection...

Accellion FTA - getStatus verify_oauth_token Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Accellion FTA getStatus verifyoauthtoken Command Execution', 'Description' = %q This module exploits a metacharacter shell injection...

Malicious Gaming App Infects More than 1 Million Android Users

It's not at all surprising that the Google Play Store is surrounded by a number of malicious applications that may gain users' attention to fall victim for one, but this time it might be even worse than you thought. Threat researchers from security firm ESET have discovered a malicious...

Acunetix v10 - Web Application Security Testing Tool

Acunetix, the pioneer in automated web application security software, has announced the release of version 10 of its Vulnerability Scanner. New features are designed to prevent the risk of hacking for all customers; from small businesses up to large enterprises, including WordPress users, web...

On (OAuth) token hijacks for fun and profit part #1 (Google/Microsoft integration)

Here we go again.... I have already blogged about OAuth token hijacks 1 2 , but hey, things happens and re-happens : In the past I had mainly focused my attention on Authorization Servers weakness. As the cited Facebook's vulnerable regex pattern matching for redirecturi. It turns out that also...

Coinbase: OAuth authorization page vulnerable to clickjacking

Due to a misconfiguration, the 'authorize' button on the OAuth authorization page was vulnerable to clickjacking. The bug was fixed by ensuring our OAuth-related responses included the same security headers including X-Frame-Options as the rest of the site...

Legal Robot: Registration bypass using OAuth logical bug

Security researcher discovered that OAuth login bypassed the intended registration/waitlist process during the private beta...

Design/Logic Flaw

WebSphereOauth20SP.ear in IBM WebSphere Application Server WAS 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vecto...

CVE-2015-1885

WebSphereOauth20SP.ear in IBM WebSphere Application Server WAS 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vecto...

CVE-2015-1885

CVE-2015-1885 affects IBM WebSphere Application Server: vulnerable when OAuth password grant is used. Affects WebSphere Application Server Full/Profile: 8.5 (Liberty 8.5) up to 8.5.5.x, 8.0 up to 8.0.0.10, and 7.0 up to 7.0.0.38/39. Root cause: OAuth ear (WebSphereOauth20SP.ear) handling allows p...

Shopify: Open redirection in OAuth

Hello, When we specify an invalid scope then the authorize url redirects to the site mentioned in redirecturi. So, attacker can create an app and use it as open redirector to redirect victims to fake sites. eg. Attacker can host same phishing page and hack the victims. Proof Of Concept :...

Open redirect in rfc6749 aka 'The OAuth 2.0 Authorization Framework'

!Image result for meme all the...

Internet Bug Bounty: Race Conditions in OAuth 2 API implementations

Most of OAuth 2 API implementations seem to have multiple Race Condition vulnerabilities for processing requests for Access Token or Refresh Token. Race Condition allows a malicious application to obtain several accesstoken and refreshtoken pairs while only one pair should be generated. Further, ...

Synology.com Cross Site Scripting

Exploit Title: Synology.com sub-domain OAuth exchange Reflected XSS RXSS Date: 03/04/2014 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.synology.com Version: / Category: Reflected Cross Site Scripting Google dork: Tested on: Synology.com update sub-domain Synology description ...