Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

eval.blog

Post reply on HN
Print view View original

91–100 of 114 posts

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#91

Post by pgraf »

jorge_leria wrote: post #70

Hi! I'm the person in charge of managing the bug bounty program, and I'd like to shed light on what happened from our end. I already apologized and explained this to @0xcrypto internally, but I believe that I should say something here to clarify what happened. The truth here is that we were never able to fully reproduce the issue from the beginning, but struggled to close it because of the fear of missing something.…

Great to hear from you firsthand! While the issue was not reproducable for you, wouldn‘t it have been easy to have a look in the source code if the open-redirect was at all possible?

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#92

Post by humanlity »

scurvy_steve wrote: post #62
humanlity wrote: post #48

How can I solve this problem cheaply? Here are a few thoughts: - Generate an encrypted token based on the redirect state value. - Store the mapping of tenant_id and unique state. - wait Microsoft support wildcard redirects.

First, just don't enable implicit grant. That makes it a lot harder to screw up. State is for preventing CSRF, not transferring data. Don't abuse state, it's wrong. Use your own authorize url, add an encrypted cookie and redirect to the real one. Even if the cookie is encrypted, only put some kind of session/cache key in it, don't actually send "info". Read cookie in callback then delete it.

Ok, I get it, Thanks

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#93

Post by h_tbob »

jorge_leria wrote: post #70

Hi! I'm the person in charge of managing the bug bounty program, and I'd like to shed light on what happened from our end. I already apologized and explained this to @0xcrypto internally, but I believe that I should say something here to clarify what happened. The truth here is that we were never able to fully reproduce the issue from the beginning, but struggled to close it because of the fear of missing something.…

Honestly, just makes me happy your posting that you at least take it seriously. Nobody's perfect, but in my opinion things get out of hand when people don't take responsibility when mistakes happen. Good work, I know it's not your fault, need more people like you out here fixing.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#94

Post by lstamour »

Operyl wrote: post #65
michaelt wrote: post #64

Earlier quoted context omitted.

It's kinda normal that you'd want to let a user log in and return them to the page they were at. For example, if you're making a shopping website and a user asks to put something in their basket and you send them to log in, you'd want to return them to the item they were about to buy, not dump them back at the homepage. What's the proper way of doing this, without "abusing state" ?

Store the basket in a temporary cookie, not the oauth state parameter.

Also only allow redirects to your domain or website, not literally anywhere on the internet. And the token should stay in your website’s cookies - it’s unclear why the second redirect would ever need to pass a token if it can read it from site cookies in the first place.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#95

Post by 0xcrypto »

jorge_leria wrote: post #70

Hi! I'm the person in charge of managing the bug bounty program, and I'd like to shed light on what happened from our end. I already apologized and explained this to @0xcrypto internally, but I believe that I should say something here to clarify what happened. The truth here is that we were never able to fully reproduce the issue from the beginning, but struggled to close it because of the fear of missing something.…

Well mistakes happen. One thing that is still not explained is that I contacted Hackerone many times in the timespan of 3 years but they couldn't get in contact with you either.

Also, it is still unclear how you wanna continue with the report since it is no longer reproducible. I would have discussed it further on Hackerone but apparently I have been ghosted again after the apologize message.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#96

Post by jorge_leria »

0xcrypto wrote: post #95
jorge_leria wrote: post #70

Hi! I'm the person in charge of managing the bug bounty program, and I'd like to shed light on what happened from our end. I already apologized and explained this to @0xcrypto internally, but I believe that I should say something here to clarify what happened. The truth here is that we were never able to fully reproduce the issue from the beginning, but struggled to close it because of the fear of missing something.…

Well mistakes happen. One thing that is still not explained is that I contacted Hackerone many times in the timespan of 3 years but they couldn't get in contact with you either. Also, it is still unclear how you wanna continue with the report since it is no longer reproducible. I would have discussed it further on Hackerone but apparently I have been ghosted again after the apologize message.

Hey 0xcrypto, I'm very sorry if I gave the impression that we weren't open to discussing anything further on the original issue. After my message, we only received a short comment from you. The issue actually will be still open for a short while just in case you want to discuss further details. Let's continue the conversation there.

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#97

Post by weird-eye-issue »

andix wrote: post #87
tourist2d wrote: post #86

Earlier quoted context omitted.

He manages the big bounty program. Why would you think he would be interested in your personal UX issues with the app?

I think you have a wrong impression of the size of the company. According to their website they have 26 engineers in total. And I would doubt that those are my "personal" UX issues.

Exactly. 26 engineers alone. That is way past the size where they are not even close to being part of the iOS team

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#99

Post by 0ETH-JP »

Good to know that an accident caused education or possible intent/ my life in a nutshell is wrapped around curly braces or 0eth limits of imagination. -on the other hand base2 mathematics is about as intriguing for the average person human experience or augmented reality. We had a great time deciding intent or purpose for research that didn’t start case files with day1 or private practice or contract but it wasn’t just this case of you look at the transfer of data from a computer view it’s taking the path of least interest for intent or excusable bipolar circuitry’s since ohms law was a Trending topic for engineering students.. if you see a pattern of the norm through greed or monetizing a new way to fool the next the button space bar was not just space exploration downpress.. we are greedy at nature but still to find hope of future generations box is one less hacker 1 case we see . The protocol drivers were never expected to array or say imprint to the spool of knowledge. Everybody sees the problem in our brains we are programmed to develop work arounds for habituation intention. Who wants to sue BG not me but for the fact that and understand how or why binary systems can evolve into tricking people and a entire generation regeneration cycle between our days and days leftist will lobby null hypothesis and preach a beta tester from Islamic nations is only capable to learn within there own framework and environment.. now evolution will change into something we call Ai when technology has solid proof of learning a new hobby without internet or WiFi so their brains will become more advanced by repetition of Or religion based keywords.. dao coining mining technology isn’t just a profit it’s a process and not our choice but we should be able to make it less likely to be confused or so easy to learn a “me” signal on our own time invest in American diesel repairs llc in physics of diesel technology.. this was a very important thing to live through by investing in ourselves and our communities by choosing “Integrity over compromise “ I’ve been offered a dollar worth of coin that allows the other to breach me.. and possibly affect our own people customers and there environments.. Oeth choice of truth is 110% always been teaching itself how to handle adaptation for healing a broken heart or broken soul.. in the end we will never know how I did recreate it but it wasn’t my intention.. it’s only plausible that we will now know how to handle this gift from my own experiences and loss.. talent is not all it takes it’s a way of life. Ty for examples

Re: Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App

#100

Post by [deleted] »

jussij wrote: post #15
meibo wrote: post #12

Earlier quoted context omitted.

Microsoft checks the return URL to see if it is one of the whitelisted URLs specified by Harvest. Harvest added their own redirection mechanism on top of this, presumably to support multiple instances of their software, which did not do a good job of sanitizing input values for their redirect. So no, this is not an implicit issue with oauth, just a shoddy implementation.

Ok, I think I understand but correct me if I'm wrong. Normally that return URL would be hidden from view, as it would live in configuration detail found inside of the Microsoft system, attached to the client_id. However, Harvest weakened this security by adding in the additional (and unsafe) return_to parameter to manage their return URL.

[deleted]
Post reply on HN