Login to any user account using other Facebook app access token (2015)

https://hackerone.com/reports/101977

by Bikee • 3 years ago

18 16 3 years ago

maxboone• 3 years ago

Isn't this the point of JWTs that are signed with a shared secret (or public-private) but contain the right / necessary scopes?

cjonas• 3 years ago

Pretty sure this is based on one of those "login with Facebook" oAuth apps where your just using Facebook as the IDP. They were probably using the token to lookup the email address (via 'profile' scope) but not validating that the token originated from their connected app. Also, this is why the "client secret" needs to be kept secret (so a hacker can't trick users to login via your connected app)

apsurd2• 3 years ago

the jwt isnt tampered with. imgur servers did not validate the decoded payload matched their fb app id. it says in the docs be sure too match on the app id because fb isn't going through the ceremony of checking that your oAuth key is registered to a specific app id and therefore only valid together. app id is considered arbitrary payload metadata in this sense.

tiarafawn• 3 years ago

This problem/attack is called "confused deputy". It's surprisingly hard to find a link that correctly explains the problem and its mitigations. This one is correct but not very verbose: https://medium.com/@fhbro/confused-deputy-c9e75eb7df00#8edf

grayhatter• 3 years ago

reported 8 years ago... why is this relevant today?

also, this is a bug report for imgur, not Facebook so this is super misleading title.

apsurd2• 3 years ago

i'm interested in the sense imgur is terrible for not rewarding a bounty, and should be called out. 8 years may be a little too late though.

archo• 3 years ago

https://archive.is/gTQt5

kramerger2• 3 years ago

No bounty was paid for this, and the average imgur payout is only $100.

I feel the bug bounty scene is very crowded and most companies will treat you as an imbecile.

behringer2• 3 years ago

Absolutely you are if you give them the bug before promise of payment. You're always best off disclosing publicly if they don't want to pay you.

kramerger2• 3 years ago

But that's the whole point of a commercial bug bounty program

CSDude• 3 years ago

We set a huge disclaimer on previous company with almost 100 items for the things that are not valid for a bug report. The quality of reports received is subpar, but it's still best quality of sources for finding out vulnerabilities. Though it's expensive for me for now.

Zetobal• 3 years ago

Not paying bounty for a bug like that is a good way to compromise your corps security.

jesprenj• 3 years ago

Please add (2015) to the title.

harles• 3 years ago

Attck: Hacker can build own facebook app and get victim's facebook access token and use that access token to login into imgur account

I’m not sure I follow this. This sounds like “phish user credentials, then use user credentials.” What am I missing?

TrianguloY• 3 years ago

Reading from other comments I think it goes as follows:

This is related to SSO (single sign on) where imgur didn't check the source of the token.

So, if you built an app that used SSO with Facebook (so that any user can log into your app with their Facebook credentials, but without you knowing them) you could use that SSO information for your app to log into imgur as that user.

Because imgur wasn't checking that the token was from their own app. The token is just a Facebook response that says something like "this is user X and they wants to log into app Y, signed by Facebook". If you don't check Y...

Login to any user account using other Facebook app access token (2015)

Related Stories