Full Disclosure mailing list archives

By Date By Thread Logical Flaw in Google's OAuth From: vishnu raju <rajuvishnu52 () gmail com>

Date: Sat, 30 May 2015 14:32:26 +0530

Hi List, Greetings from Vishnu(@dH4Wk) This is a responsible disclosure. Google brushed of this finding, as in their point of view everything works as intended :-P.. *Summary* Google's OAuth is used by many third party vendors to authenticate their users. Condition for the bug to be exploited: An active Google session *Affected Parties*: [1] Google users [2] Third parties who use google OAuth Affected Security Aspects [1] Authentication [2] Authorization *Vulnerability Description:* Any attacker who can access a system with an active session can "*hijack*" the active (victim's) user profile to *authorize a third part*y. *Reproduction*: [1] Two active google accounts on the same system (say USER1 or USER2) [2] Access any third party website that uses Google's OAuth for authentication [3] Google may ask for login [4] Authenticate with USER2's (USER1 => Victim, USER2 => Attacker) [5] After authentication the page is redirected to a permission page for Authorization [6] Change the user to USER1. Can be done in following ways (a) Make use of the switch user option on the right side top of the page (b) simply change the authuser=1 to 0 in the URL [7] You will be logged to the third party using USER1's profile. *Conclusion* The attack scenario is not rare as any one thinks. I myself has seen active sessions when accessing public computers (say Library). This attack is a result of a logical flaw and all third parties using Google OAuth are affected irrespective of how secure they are in all other ways. Regards, Vishnu Raju. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/ By Date By Thread Current thread: Logical Flaw in Google's OAuth vishnu raju (May 31)