4 ms·

I am being a bit slow today. How did Mallory come into the picture at step 4? By exploiting some other web app vulnerability on example.com?

• jmathai 13y ago
  Example.com has an open redirect; say http://example.com/redirect?url=xxxxx http://example.com/redirect?url=xxxxx Craft the OAuth URL to Twitter passing the callback as http://example.com/redirect?url=http://mallory.com/capture http://example.com/redirect?url=http://mallory.com/capture. Now Mallory can access the parameters passed back by Twitter at /capture on their server. Questions: 1. You have to look at the referer to get the tokens, no? 2. OAuth 1.0a isn't vulnerable because the requests are signed with a secret, correct?
  • saleemshafi 13y ago
    my understanding is that OAuth 1.0a isn't vulnerable because in that spec, the access_token isn't part of the post-user-authorization redirect (http://tools.ietf.org/html/rfc5849#section-2.2 http://tools.ietf.org/html/rfc5849#section-2.2) while it is in Oauth 2.0 (http://tools.ietf.org/html/rfc6749#section-4.2.2 http://tools.ietf.org/html/rfc6749#section-4.2.2) So, in Oauth 2.0 the redirect URI could be setup to expose the access token. In Oauth 1.0a, the only thing that could leak is the request token and verifier code, but without the original client credentials, they can't be exchanged for an access token.