Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

eval.blog

Post reply on HN
Print view View original

1–10 of 114 posts

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#3

Post by politelemon »

lsowen wrote: post #2

It took THREE YEARS (August 2020 - August 2023) to fix the vulnerability? I'm not sure the size of the Harvest team, but that still seems insane.

I'm guessing, as would be typical of many companies, it ended up on a backlog as low priority, survived a few Jira reorganisations and corporate restructuring, before eventually being noticed and fixed.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#5

Post by bonzini »

politelemon wrote: post #3
lsowen wrote: post #2

It took THREE YEARS (August 2020 - August 2023) to fix the vulnerability? I'm not sure the size of the Harvest team, but that still seems insane.

I'm guessing, as would be typical of many companies, it ended up on a backlog as low priority, survived a few Jira reorganisations and corporate restructuring, before eventually being noticed and fixed.

Probably fixed without even noticing when a dependency was updated...

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#6

Post by config_yml »

politelemon wrote: post #3
lsowen wrote: post #2

It took THREE YEARS (August 2020 - August 2023) to fix the vulnerability? I'm not sure the size of the Harvest team, but that still seems insane.

I'm guessing, as would be typical of many companies, it ended up on a backlog as low priority, survived a few Jira reorganisations and corporate restructuring, before eventually being noticed and fixed.

They're a small company with an even smaller engineering team, I think 13 devs or something like that. I would imagine either everyone knows about it immediately or they are too overloaded with work that it gets deprioritised into oblivion after a quick first look.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#9

Post by lol768 »

config_yml wrote: post #6
politelemon wrote: post #3

Earlier quoted context omitted.

I'm guessing, as would be typical of many companies, it ended up on a backlog as low priority, survived a few Jira reorganisations and corporate restructuring, before eventually being noticed and fixed.

They're a small company with an even smaller engineering team, I think 13 devs or something like that. I would imagine either everyone knows about it immediately or they are too overloaded with work that it gets deprioritised into oblivion after a quick first look.

It's not an excuse, it's just poor engineering culture or lack of security awareness. I work with an engineering team of 5 - security issues still get prioritised and fixed. Feature work gets deprioritised, as it should, as soon as there's a credible security concern.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#10

Post by lawgimenez »

config_yml wrote: post #6
politelemon wrote: post #3

Earlier quoted context omitted.

I'm guessing, as would be typical of many companies, it ended up on a backlog as low priority, survived a few Jira reorganisations and corporate restructuring, before eventually being noticed and fixed.

They're a small company with an even smaller engineering team, I think 13 devs or something like that. I would imagine either everyone knows about it immediately or they are too overloaded with work that it gets deprioritised into oblivion after a quick first look.

If they had time to rewrite the whole native app to React Native then they should have enough time to triage this security issue.
Post reply on HN