8 ms·

> Vidio, an online streaming platform with 100 million monthly active users, the researchers found that when logging into the site through Facebook, the site di

> Vidio, an online streaming platform with 100 million monthly active users, the researchers found that when logging into the site through Facebook, the site did not verify the token — which the website developers and not OAuth must do. Because of this, an attacker could manipulate the API calls to insert an access token generated for a different application, the researchers found. How does this work? I thought the token was an opaque hex string and only had meaning when sent back to the original server?

vladvasiliu 3y ago
IIRC, the user woud get an access token from Facebook for the target site, e.g. Vidio. Vidio then has to make sure that not only is the token actually signed by Facebook, but also that Vidio is the token's audience. The token shouldn't be opaque to Vidio. I'm in no way an authority on OAuth, but I think the "opaque token" you're talking about is in the situation when Vidio would want to access Facebook on the user's behalf: they would get an access token for Facebook. The token can be opaque to Vidio.
- Incipient 3y ago
  Not being a full expert on it either, that flow is roughly right. Vidio does have to validate it. The entire pkce flow is bloody painful to implement, and it's actually quite hard to do it perfectly, and easy to accidentally skip a part of it and have it seemingly work ok.
tommiegannert 3y ago
The original article [1] explains it much further: > As you read previously, according to the Facebook documentation, when Vidio.com receives the access token from the user, Vidio should verify that the access token was generated to its App ID (92356) by calling the https://graph.facebook.com/debug_token https://graph.facebook.com/debug_token API. Confirming what vladvasiliu said. 1. https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove...
- arcastroe 3y ago
  Gitea serves as an OIDC provider: * https://docs.gitea.com/next/development/oauth2-provider https://docs.gitea.com/next/development/oauth2-provider However, I don't see an equivalent API in gitea to the "debug_token" api. If I'm developing an application that allows "Login with Gitea", how do I make sure my application is not vulnerable?
  - vladvasiliu 3y ago
    See caseysoftware's reply: https://news.ycombinator.com/item?id=38022536 https://news.ycombinator.com/item?id=38022536 The access token usually has an `aud` field that says for whom it is. I'm not familiar with Gitea's implementation, but reading your link, it would seem that it acts as an oauth2 provider so that 3rd parties can access Gitea, not some other random app. > Gitea supports acting as an OAuth2 provider to allow third party applications to access its resources with the user's consent.
caseysoftware 3y ago
The token can be a opaque string but doesn't have to be. Often, it's a JWT which can be decoded, validated, and used locally without a trip to the auth server. It looks like Vidio, etc validated the signature of the JWT properly but didn't check the "aud" or audience claim, which defines who should use it. Therefore, it was a valid token, it was for the target user, but the token itself wasn't for Vidio. It's the equivalent of buying a ticket for a United Airlines flight, going to the airport, and United letting you get on ANY flight because you have a valid ticket. Background: I helped build the Okta OAuth product (not related to the breaches) and I'm the author of the top OAuth/OIDC course on linkedIn.
- withinboredom 3y ago
  Heh, this is exactly how I got on the wrong flight once (the gate changed and I didn’t realize it), the machine didn’t tell the person I was getting on the wrong flight and the attendant didn’t notice. The only reason I discovered I was on the flight is because someone else had a ticket for my seat. The security people were very curious how I did it, both pilots were very pissed (both flights had to be stopped from leaving the gate until they were sure I didn't leave a bag on one of the flights, yay terrorism). But now you can’t do that any more.
- magicalhippo 3y ago
  Not just aud, but also issuer and you should check it was signed by a proper certificate no? https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens#validate-tokens https://learn.microsoft.com/en-us/entra/identity-platform/ac...
  - vladvasiliu 3y ago
    Indeed. In my case, I was initially confused by the fact that in most examples (specifically for Azure AD, which is what I've used), they give you an access token for another app, here MS Graph API. It specifically says you're not supposed to read that access token, so you can't validate it. You should use the ID token instead (which can be validated), but in the default configuration, the ID token doesn't carry much information, so you need to call the `userinfo` endpoint with said opaque access token.

vladvasiliu 3y ago

IIRC, the user woud get an access token from Facebook for the target site, e.g. Vidio. Vidio then has to make sure that not only is the token actually signed by Facebook, but also that Vidio is the token's audience. The token shouldn't be opaque to Vidio. I'm in no way an authority on OAuth, but I think the "opaque token" you're talking about is in the situation when Vidio would want to access Facebook on the user's behalf: they would get an access token for Facebook. The token can be opaque to Vidio.

Incipient 3y ago
Not being a full expert on it either, that flow is roughly right. Vidio does have to validate it. The entire pkce flow is bloody painful to implement, and it's actually quite hard to do it perfectly, and easy to accidentally skip a part of it and have it seemingly work ok.

tommiegannert 3y ago

The original article [1] explains it much further: > As you read previously, according to the Facebook documentation, when Vidio.com receives the access token from the user, Vidio should verify that the access token was generated to its App ID (92356) by calling the https://graph.facebook.com/debug_token https://graph.facebook.com/debug_token API. Confirming what vladvasiliu said. 1. https://salt.security/blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove...

arcastroe 3y ago
Gitea serves as an OIDC provider: * https://docs.gitea.com/next/development/oauth2-provider https://docs.gitea.com/next/development/oauth2-provider However, I don't see an equivalent API in gitea to the "debug_token" api. If I'm developing an application that allows "Login with Gitea", how do I make sure my application is not vulnerable?
- vladvasiliu 3y ago
  See caseysoftware's reply: https://news.ycombinator.com/item?id=38022536 https://news.ycombinator.com/item?id=38022536 The access token usually has an `aud` field that says for whom it is. I'm not familiar with Gitea's implementation, but reading your link, it would seem that it acts as an oauth2 provider so that 3rd parties can access Gitea, not some other random app. > Gitea supports acting as an OAuth2 provider to allow third party applications to access its resources with the user's consent.

caseysoftware 3y ago

The token can be a opaque string but doesn't have to be. Often, it's a JWT which can be decoded, validated, and used locally without a trip to the auth server. It looks like Vidio, etc validated the signature of the JWT properly but didn't check the "aud" or audience claim, which defines who should use it. Therefore, it was a valid token, it was for the target user, but the token itself wasn't for Vidio. It's the equivalent of buying a ticket for a United Airlines flight, going to the airport, and United letting you get on ANY flight because you have a valid ticket. Background: I helped build the Okta OAuth product (not related to the breaches) and I'm the author of the top OAuth/OIDC course on linkedIn.

withinboredom 3y ago
Heh, this is exactly how I got on the wrong flight once (the gate changed and I didn’t realize it), the machine didn’t tell the person I was getting on the wrong flight and the attendant didn’t notice. The only reason I discovered I was on the flight is because someone else had a ticket for my seat. The security people were very curious how I did it, both pilots were very pissed (both flights had to be stopped from leaving the gate until they were sure I didn't leave a bag on one of the flights, yay terrorism). But now you can’t do that any more.
magicalhippo 3y ago
Not just aud, but also issuer and you should check it was signed by a proper certificate no? https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens#validate-tokens https://learn.microsoft.com/en-us/entra/identity-platform/ac...
- vladvasiliu 3y ago
  Indeed. In my case, I was initially confused by the fact that in most examples (specifically for Azure AD, which is what I've used), they give you an access token for another app, here MS Graph API. It specifically says you're not supposed to read that access token, so you can't validate it. You should use the ID token instead (which can be validated), but in the default configuration, the ID token doesn't carry much information, so you need to call the `userinfo` endpoint with said opaque access token.