Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

eval.blog

Post reply on HN
Print view View original

41–50 of 114 posts

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#41

Post by drawkbox »

tptacek wrote: post #39

Is Harvest an important app? Implicit-flow open redirect bugs are pretty bread-and-butter, so it's odd to see one at the top of HN. Are people reading this title as if it was a major Microsoft vulnerability?

Might be misdirection PR because of the recent Okta issues which were directly at Okta. [1] Okta having lots of issues last few years. [2]

[1] https://arstechnica.com/security/2023/10/okta-says-hackers-b...

[2] https://en.wikipedia.org/wiki/Okta,_Inc.#Security_incidents

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#43

Post by matja »

RFC 6749 goes into details on how the authorization server should prevent this type of attack

    The authorization server MUST require public clients and SHOULD require
    confidential clients to register their redirection URIs.  If a redirection
    URI is provided in the request, the authorization server MUST validate it
    against the registered value.
So how is this possible, when presumably the Harvest app did not register the malicious redirect_uri?

Does the Microsoft OAuth server ignore URL parameters within a redirect_uri when comparing with registered redirect URIs for the OAuth client?

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#44

Post by Uvix »

matja wrote: post #43

RFC 6749 goes into details on how the authorization server should prevent this type of attack The authorization server MUST require public clients and SHOULD require confidential clients to register their redirection URIs. If a redirection URI is provided in the request, the authorization server MUST validate it against the registered value. So how is this possible, when presumably the Harvest app did not register th…

The Harvest redirect_uri is registered with Microsoft. Harvest implements its own redirect after the Microsoft OAuth server redirects to them, based on the data in the state.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#45

Post by [deleted] »

belter wrote: post #17

Worth quoting here... "...In the process of disclosing and patching this vulnerability, the Harvest team was barely responsive. The company acknowledged the vulnerability by triaging but took a very long time to fix the vulnerability. After 3 years of reporting, the company finally fixed the vulnerability silently and didn't bother to inform...no bounty or even HackerOne points were rewarded by the company..." And fr…

[deleted]

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#47

Post by 0xcrypto »

nurple wrote: post #25

The headline seems pretty unfair to Microsoft here, seemingly to capitalize on the press of their recent auth disaster. The first thought that came to my mind on reading the headline was "oh great, another MS breach". These are in fact harvest's tokens, which only erroneously exposed access to their app, because of an injection vuln in their code, and would be exactly as compromised behind any other IdP.

Hi, author of the blog post here. Yes I understand your concern and I tried keeping Microsoft's name out of the title but couldn't think of anything else. Since the vulnerability only affects the oauth implementation for the connection with Microsoft accounts. Previously the title was "Microsoft OAuth token leak via open redirect in Harvest App" but later I changed it to "Microsoft Account's OAuth tokens leaking via open redirect in Harvest App". I am still considering to change it and open to suggestions.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#50

Post by astrostl »

Well, this is disconcerting. I've used Harvest and found the support to be absolutely stellar, with prompt responses that clearly and deeply understood the nuances of how customers are using the product and detailed steps on how to creatively use existing features. Anything unimplemented yielded, "we'll put that on the backlog but no promises." Given the 30 headcount cited in engineering [1], I don't know where it goes because I didn't see other features getting cranked out either.

I started getting spammed as a "user of Harvest" which prompted me to suspect that they were selling their customer lists. They took this claim extremely seriously, connecting me with company heads immediately to issue stern denials and execute a prompt investigation. That was great.

What I think it came down to, though, was also engineering. I figured out a rather easy way to reliably infer active customers, which also, "went on the backlog" and remains unfixed months later. And it's a fix that appears to be super trivial.

They also only offer MFA if you're signing in with Google [2]. But the app itself is DAMN good at what it does.

1: https://www.getharvest.com/about/meet-the-team

2: https://support.getharvest.com/hc/en-us/articles/36005266713...

Post reply on HN