OAuth Misconfiguration

Overview of the Vulnerability

OAuth is an authorization framework used to identify and authenticate users for an application. There are a number of implementation misconfigurations which can lead to an OAuth framework being implemented insecurely. These misconfigurations can lead to a broad range of issues which could allow an attacker to manipulate or retrieve sensitive data and potentially bypass the authentication process.

Business Impact

Depending on the type of misconfiguration found in the OAuth implementation, exposure or manipulation of data from within it could lead to financial loss and reputational damage for the business.

Steps to Reproduce

  1. Enable a HTTP intercept proxy, such as Burp Suite or OWASP ZAP

  2. Use a browser to navigate to: {{URL}}

  3. With the HTTP intercept proxy turned on, login to the application and capture the response in the the HTTP intercept proxy

  4. Observe the OAuth misconfiguration

Proof of Concept (PoC)

The screenshot below demonstrates the OAuth misconfiguration:

{{screenshot}}

Guidance

Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. Your submission must include evidence of the vulnerability and not be theoretical in nature.

For an OAuth misconfiguration vulnerability, please include a screenshot or video to easily demonstrate and reproduce the issue. In the Steps to Reproduce section, please include additional steps needed to uncover the misconfiguration you have identified.

Attempt to escalate the misconfiguration to perform additional actions (such as an account takeover or insecure redirection). If this is possible, provide a full Proof of Concept (PoC).

Recommendation(s)

There is no single technique to stop OAuth misconfigurations from occurring. However, securely implementing the OAuth workflow with the right combination of defensive measures can prevent and limit the impact of these OAuth misconfigurations. Some best practices include the following:

PreviousSMS TriggersNextAccount Squatting

Last updated