Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

eval.blog

Post reply on HN
Print view View original

31–40 of 114 posts

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#31

Post by withinboredom »

mooreds wrote: post #28
genzer wrote: post #18

Earlier quoted context omitted.

The vulnerability came from the outlook-integration.harvestapp.com. It used a JSON object as `state` containing instructions once the OAuth2 Callback succeeded. The property `subdomain` was used to redirect the browser to a subdomain of harvestapp.com, passing the `#id-token`. The problem came from the fact that the value of `subdomain` was injected directly to: https://${subdomain}.harvestapp.com/...#id-token= ... B…

So it was the combination of: * the additional redirect using the JSON object in state * the `subdomain` not being properly verified * the implicit grant being supported Which allowed an attacker to get an access token for a user's Microsoft account. From my reading, this seems to be entirely an issue due to an improper implementation on Harvest's side, nothing to do with Microsoft's implementation of OAuth. Am I cor…

Clearly not, or I doubt we would be reading this blog post.

I assume that for several years though, that was exactly what Microsoft thought too.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#32

Post by DeIlliad »

addandsubtract wrote: post #26
cowsup wrote: post #19

Earlier quoted context omitted.

Of the three parties involved (HackerOne, the company, and the researcher finding the bug), the company has all of the leverage. If they feel like HackerOne is stepping on their toes and making decisions as to whether to "let" companies do things, those companies will just leave HackerOne and create an in-house solution.

HackerOne should require companies to put down 10-100k in an escrow account, that can be used to pay out security researchers on the discretion of HackerOne. Allowing companies to decide when and if a bounty is paid out doesn't make any sense in this case.

Companies just don't use HackerOne in that case and HackerOne is dead. Which is why they are beholden to the companies in question

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#33

Post by LightBug1 »

lol768 wrote: post #9
config_yml wrote: post #6

Earlier quoted context omitted.

They're a small company with an even smaller engineering team, I think 13 devs or something like that. I would imagine either everyone knows about it immediately or they are too overloaded with work that it gets deprioritised into oblivion after a quick first look.

It's not an excuse, it's just poor engineering culture or lack of security awareness. I work with an engineering team of 5 - security issues still get prioritised and fixed. Feature work gets deprioritised, as it should, as soon as there's a credible security concern.

You must work at a half-decent outfit then.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#34

Post by 93po »

belter wrote: post #17

Worth quoting here... "...In the process of disclosing and patching this vulnerability, the Harvest team was barely responsive. The company acknowledged the vulnerability by triaging but took a very long time to fix the vulnerability. After 3 years of reporting, the company finally fixed the vulnerability silently and didn't bother to inform...no bounty or even HackerOne points were rewarded by the company..." And fr…

"Harvest cares deeply about profiting from the illusion of the privacy around the data we harvest from customers. Profit is one of the core values at the heart of our business"

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#35

Post by 93po »

eterm wrote: post #7

I really feel like Hackerone isn't really holding up their end of the bargain if they let companies sit on things like this for 3 years.

Maybe they just need company reviews so people can avoid the shitty ones that take years and don't pay out

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#36

Post by charles_f »

nurple wrote: post #25

The headline seems pretty unfair to Microsoft here, seemingly to capitalize on the press of their recent auth disaster. The first thought that came to my mind on reading the headline was "oh great, another MS breach". These are in fact harvest's tokens, which only erroneously exposed access to their app, because of an injection vuln in their code, and would be exactly as compromised behind any other IdP.

Agreed, that was my thoughts as well, to the point where I even wondered if the article knew how oauth works to claim these are msft tokens

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#37

Post by bavell »

mohon wrote: post #24
genzer wrote: post #18

Earlier quoted context omitted.

The vulnerability came from the outlook-integration.harvestapp.com. It used a JSON object as `state` containing instructions once the OAuth2 Callback succeeded. The property `subdomain` was used to redirect the browser to a subdomain of harvestapp.com, passing the `#id-token`. The problem came from the fact that the value of `subdomain` was injected directly to: https://${subdomain}.harvestapp.com/...#id-token= ... B…

Good explanation. Quick follow up, so to resolve this issue, what I have in mind are : 1. Make sure the redirect url is a valid harvestapp.com (more checks on state) 2. Encrypt the state since the start of the request, so then they can double check the state hasn't been forged by decrypt and compare Is there any option beside those?

Why not just use a random ID and pull from DB instead of shuffling around a json payload? Really trying to avoid that DB hit? Just pay the price imo

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#38

Post by Aurornis »

eterm wrote: post #7

I really feel like Hackerone isn't really holding up their end of the bargain if they let companies sit on things like this for 3 years.

I dealt with a HackerOne issue from the company side where the HackerOne participant was constantly violating HackerOne’s own rules: Breaking disclosure timelines, posting false social media statements about the bug, and even threatening our employees.

HackerOne didn’t care. No matter how many times we pointed out the person was violating their own rules, they claimed they couldn’t do anything.

It felt like a company that had been built up to steady state operations, then stripped down to a bare minimum operating crew where questions were answered by powerless support people.

This was a while ago. Maybe things have changed, but that was my impression at the time.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#40

Post by tptacek »

mooreds wrote: post #8

Man, the implicit grant is pretty horrible, for exactly the reasons shown in this post. FYI, they are omitting it in the upcoming OAuth 2.1 spec: https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-09.htm...

It's been deprecated for like 6 years now, too, right? There'd be no reason to keep it in the new spec, since CORS obsoletes it.
Post reply on HN