A new OAuth vulnerability has been discovered in three of the major extensions such as Grammarly, Vidio, and Bukalapak. These applications use the OAuth protocol for their authentication, which is vulnerable to an authentication token-stealing attack.
OAuth is an authentication protocol that was introduced in 2006 and acts as a passwordless signing-in for many applications through social media accounts such as Facebook, Twitter, or Google.
This particular flaw could affect millions of users as all of these affected vendors have combined to have more than 100M users. However, all of the affected vendors acted swiftly upon the reported issues and fixed them accordingly.
Account TakeOver Due to Lack of Token Validation
If an application has implemented OAuth authentication for its users, the application must validate if the authentication token is from a legitimate vendor or a malicious token.
In such a case, if the applications do not validate the token, threat actors can create a malicious website and insert their token from Facebook or Google to hijack the user’s account on the affected application.
Moreover, threat actors can lure multiple victims and perform massive account hijacking if the website has a great reputation.
For demonstration purposes, researchers created a malicious website with Facebook developers and gained an OAuth authentication token for their application.
Furthermore, they replaced this token with this vulnerable application’s authentication token, which resulted in an account hijack.
It was also mentioned that these were just sample applications, and there are still thousands of applications that lack this token validation and are vulnerable to massive account hijacks.
A complete report about this attack has been published by Salt Security, which provides detailed information about the attack, source code, mechanism, and other information.
It is recommended that developers implement a token validation for OAuth tokens to prevent this kind of exploitation by threat actors.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.
