Hello Amazing Hackers… Abdelhy khaled is Here
In this in Article and I will talk about how I found Account Squatting due to OAuth misconfiguration in public bug bounty program
Brief about what is an Account takeover vulnerability?
OAuth is an authorization framework used to identify and authenticate users for an application. There are a number of implementation misconfigurations which can lead to an OAuth framework being implemented insecurely.
During the OAuth based account registration process, the OAuth authorization flow creates a new account for an email address and grants access via an OAuth token without checking if there is a pre-existing account for the same email address. This allows an attacker to register an account with a legitimate email and “squat” on the account. When the legitimate user creates an account with their email address using the OAuth workflow, they are unknowingly logged into the original account that the attacker created. This means that the attacker is still able to access the account.
So let’s go
Its a very simple logical flaw that results in this
So suppose we are email@example.com , now login into the website then
- go to account settings and change mail address to firstname.lastname@example.org
- a link will be sent to email@example.com, now the user realizes that he have lost access to firstname.lastname@example.org due to some reasons
- so he will probably change mail to the another mail address for e.g email@example.com which he owns and has access to
- but it is found that even after verifying firstname.lastname@example.org, the old link which was sent to email@example.com is active, so user/attacker having access to that mail can verify it and Observe the OAuth misconfiguration that leads to account takeover
In a nutshell :
It is mandatory for a web app to invalidate the tokens in time to secure its user
In this case, suppose while changing mail address the user mistakenly typed wrong mail address, so the link will be sent to that mail address.
So the user probably don’t want the user of that mail address to verify it, so he will quickly change his mail address to one he owns and verify it
what he doesn’t know is that even after verification(change of major state), the old link is still active
the flaw :
user changes mail to firstname.lastname@example.org -> user realizes that he mistyped the mail -> so he again changes to mail he owns and verifies it -> old link sent to email@example.com is still active even after new mail has been verified
Thank you for taking the time to read this piece. Kindly remember to leave a comment sharing your thoughts on the blog.
Feed | LinkedIn — My LinkedIn Profile