Oauth - Attacks

Attack on Connect Request

Many sites let users connect to others (LinkedIn, Instagram, Twitter) via OAuth. Attackers can exploit this to link their fake accounts with a victim’s client account.

Steps

• Attacker creates a fake account on the provider’s site.
• Attacker starts a connect operation with the client but halts redirects.
• Attacker builds a malicious web page that:
  • Uses CSRF to log the victim out of the provider.
  • Uses CSRF to log the victim back in with the attacker’s fake account.
  • Spoofs the connect request using an iframe.
• When the victim visits the malicious page, the fake account gets linked to the client.
• Attacker can then log into the victim’s client account using the fake provider account.

Attack on redirect_uri

Clients usually register specific redirect URIs. If an attacker finds an XSS flaw in a client domain, they can capture authorization codes.

Steps

• Attacker finds a vulnerable page: https://xyz.com/vuln.
• Injects malicious JavaScript that sends URLs to attacker.
• Crafts a malicious OAuth link with redirect_uri pointing to the vulnerable page.
• Victim clicks link, gets redirected with authorization code in URL.
• Code is exfiltrated to attacker, who exchanges it for access tokens.

CSRF on Authorization Response

An attacker can use CSRF to trick the victim into connecting the attacker’s fake provider account to the victim’s client account.

Steps

• Attacker registers a fake provider account.
• Starts connect with client, stores authorization_code.
• Tricks victim into loading https://xyz.com/<provider>/login?code=Auth_Code.
• Victim unknowingly links attacker’s provider account to their client account.
• Attacker can then log in as the victim on the client.

Access Token Reusage

OAuth requires unique access tokens, but some systems allow token reuse across clients, especially with implicit grants.

Steps

• Attacker registers a legitimate clientA.
• Lures victim into using clientA and captures access token.
• Victim later uses clientB with implicit grant.
• Attacker reuses access token from clientA on clientB.
• Attacker is authenticated as victim.

SSRF via Dynamic Client Registration

Some OAuth servers expose /register endpoints for dynamic client registration. Attackers can use this to trigger SSRF.

Example POST request

POST /connect/register HTTP/1.1
Content-Type: application/json
Host: server.certifiedhacker.com
Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJ...

{
 "application_type": "web app",
 "redirect_uris": ["https://client.certifiedhacker.com/callback"],
 "client_name": "Sample Test",
 "logo_uri": "https://client.certifiedhacker.com/logo.png",
 "subject_type": "pairwise",
 "sector_identifier_uri": "https://certifiedhacker.com/rdrct_uris.json",
 "token_endpoint_auth_method": "client_secret_basic",
 "jwks_uri": "https://client.certifiedhacker.com/public_keys.jwks",
 "contacts": ["[email protected]"],
 "request_uris": ["https://client.certifiedhacker.com/rf.txt"]
}

Vulnerable Parameters

• logo_uri: Server may fetch attacker-controlled logo.
• jwks_uri: Attacker can register malicious JWKS endpoint.
• request_uris: Attacker-controlled URIs used during authorization.