3 ms·

A quite common error, actually. Lots and lots of services are configured to accept logins from arbitrary auths, but forget to verify that it's an auth they actu

A quite common error, actually. Lots and lots of services are configured to accept logins from arbitrary auths, but forget to verify that it's an auth they actually trust! You just check that it's a valid oauth token, and your code works for your login page, so you consider your login-feature to be done and move on to something else, leaving a wide open door. Edit: As the article itself stated, around 25% of all systems with this setup are vulnerable! > The results surprised us: 25% of all the multi-tenant apps we scanned were vulnerable to authentication bypass.

jacquesm 4y ago
And sometimes they fail 'open' so when the auth provider goes down all authentication evaporates and you have access to everything.
- londons_explore 4y ago
  Fail open can be the right choice for some applications. Especially if you have logging of user credentials.
RGamma 4y ago
I need to update my hacker fantasy about systems intrusion from complicated multi-stage takeover to "just log in"
- jacquesm 4y ago
  > just log in If only. How about: just download the backup of the server log from https://example.com/logfile.txt https://example.com/logfile.txt? Oh, and it contains everything. Including internal application logs.
iudqnolq 4y ago
Microsoft should never have offered an API to verify an auth token is syntactically valid without checking who it is.
- tgv 4y ago
  That's not the problem. They do check identity. The problem i the application that accepts Azure's verification as authentication and authorization.
  - deleted 4y ago
    [deleted]
matsemann 4y ago
Btw, even single-tenant can be a bit scary in this regard: You can by default log in with guest users. For instance if someone has joined a teams meeting. So unless you explicitly check permissions or disable this (for instance if you think "everyone in our org should have access to this"), you inadvertently could have external people log into your apps as well.
- hotfixguru 4y ago
  Tutorial on how to deny Guest users in Azure AD[1] In general, one should always use roles in Azure. Even if you have a flaw like this, your endpoint would be safe if you required a role to access your endpoint. For multi-tenants, I completely this misconfiguration, there’s no real warnings when configuring it. In order to lock down to specific tenants, I recommend having a list of issuers that you check the token against.[2] [1] https://intility.github.io/fastapi-azure-auth/single-tenant/guest_users https://intility.github.io/fastapi-azure-auth/single-tenant/... [2] https://intility.github.io/fastapi-azure-auth/multi-tenant/accept_specific_tenants_only https://intility.github.io/fastapi-azure-auth/multi-tenant/a...

jacquesm 4y ago

And sometimes they fail 'open' so when the auth provider goes down all authentication evaporates and you have access to everything.

londons_explore 4y ago
Fail open can be the right choice for some applications. Especially if you have logging of user credentials.

RGamma 4y ago

I need to update my hacker fantasy about systems intrusion from complicated multi-stage takeover to "just log in"

jacquesm 4y ago
> just log in If only. How about: just download the backup of the server log from https://example.com/logfile.txt https://example.com/logfile.txt? Oh, and it contains everything. Including internal application logs.

iudqnolq 4y ago

Microsoft should never have offered an API to verify an auth token is syntactically valid without checking who it is.

tgv 4y ago
That's not the problem. They do check identity. The problem i the application that accepts Azure's verification as authentication and authorization.
- deleted 4y ago
  [deleted]

matsemann 4y ago

Btw, even single-tenant can be a bit scary in this regard: You can by default log in with guest users. For instance if someone has joined a teams meeting. So unless you explicitly check permissions or disable this (for instance if you think "everyone in our org should have access to this"), you inadvertently could have external people log into your apps as well.

hotfixguru 4y ago
Tutorial on how to deny Guest users in Azure AD[1] In general, one should always use roles in Azure. Even if you have a flaw like this, your endpoint would be safe if you required a role to access your endpoint. For multi-tenants, I completely this misconfiguration, there’s no real warnings when configuring it. In order to lock down to specific tenants, I recommend having a list of issuers that you check the token against.[2] [1] https://intility.github.io/fastapi-azure-auth/single-tenant/guest_users https://intility.github.io/fastapi-azure-auth/single-tenant/... [2] https://intility.github.io/fastapi-azure-auth/multi-tenant/accept_specific_tenants_only https://intility.github.io/fastapi-azure-auth/multi-tenant/a...