[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] Logical Flaw in Google's OAuth
From:       vishnu raju <rajuvishnu52 () gmail ! com>
Date:       2015-05-30 9:14:26
Message-ID: CAHB1F79q9DfZ9pxGX6Ta2QyunLZfGmAxHPCY2072kAEcJQW9Og () mail ! gmail ! com
[Download RAW message or body]

Hi List,
Greetings from Vishnu(@dH4Wk)

This is a responsible disclosure. Google brushed of  this finding, as in
their point of view everything works as intended :-P..

*Summary*
Google's OAuth is used by many third party vendors to authenticate their
users.

Condition for the bug to be exploited:
An active Google session

*Affected Parties*:
[1] Google users
[2] Third parties who use google OAuth

Affected Security Aspects
[1] Authentication
[2] Authorization

*Vulnerability Description:*
Any attacker who can access a system with an active session can "*hijack*"
the active (victim's) user profile to *authorize a third part*y.

*Reproduction*:
[1] Two active google accounts on the same system (say USER1 or USER2)
[2] Access any third party website that uses Google's OAuth for
authentication
[3] Google may ask for login
[4] Authenticate with USER2's (USER1 => Victim, USER2 => Attacker)
[5] After authentication the page is redirected to a permission page for
Authorization
[6] Change the user to USER1. Can be done in following ways
      (a) Make use of the switch user option on the right side top of the
page
      (b) simply change the authuser=1 to 0 in the URL
[7] You will be logged to the third party using USER1's profile.

*Conclusion*
The attack scenario is not rare as any one thinks. I myself has seen active
sessions when accessing public computers (say Library). This attack is a
result of a logical flaw and all third parties using Google OAuth are
affected irrespective of how secure they are in all other ways.


Regards,
Vishnu Raju.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]