0xcrypto

A question, how are you or anyone else doing this is registering bundle identifiers without opening xcode?

Fewer CVEs do not necessarily mean safety.

My only concern with such articles is the use of "god" and "religion" which only gives the majority of humanity a reason to pray more and kill anyone who disagrees.

Conscious or not, why can't we just continue calling it the universe and continue studying it as usual?

Agree with this. I tried to create objective C files in xcode 15.2 many times, spent days thinking I must have messed up somewhere and finally I found this https://forums.developer.apple.com/forums/thread/743032.

Tried updating to latest xcode, learned that my Mac's storage is almost full. Why? iOS simulator images were taking a whopping 40 GB of space even when I didnt target those iOS versions nor tested on those simulator devices. I uninstalled all the images keeping the one I build for. Next tried updating Xcode again, the issue with creating objective C files was fixed. But then it forced me to download the iOS 17.2 again along with tvOS and a bunch of other extra things. Now my space is close to full again. Why Apple? Why do I need iOS 17.2 when I build for 15.4?

You are right that redirect_uri must match the exact registered redirect_uri.

But some providers allow query parameters. For Microsoft, it was possible in 2020 when I reported the vulnerability. In 2022, they restricted query parameter support to only applications that is built for Work and School accounts and in August 2022, they added a section for this in the documentation.

See: - Commit: https://github.com/MicrosoftDocs/azure-docs/commit/c249a0548... - Current Documentation: https://learn.microsoft.com/en-us/azure/active-directory/dev...

Well mistakes happen. One thing that is still not explained is that I contacted Hackerone many times in the timespan of 3 years but they couldn't get in contact with you either.

Also, it is still unclear how you wanna continue with the report since it is no longer reproducible. I would have discussed it further on Hackerone but apparently I have been ghosted again after the apologize message.

Author of the blog post here. Yes, I agree that it wasn't Hackerone's fault and they tried their best to help.

As for the violation of agreement with hackerone, I have read the policy many times before publishing the article and even asked Hackerone about this. The vulnerability is already fixed and I haven't heard from Harvest since April 2022 so there's no point asking them as it would seem like a threat rather than an actual disclosure. An excerpt from the agreement:

Last resort: If 180 days have elapsed with the Security Team being unable or unwilling to provide a vulnerability disclosure timeline, the contents of the Report may be publicly disclosed by the Finder. We believe transparency is in the public's best interest in these extreme cases.

Oh yes, that sounds better. I am changing the title now.

Updated to "Stealing OAuth tokens of connected Microsoft accounts via open redirect in Harvest App"

Hi, author of the blog post here. Yes I understand your concern and I tried keeping Microsoft's name out of the title but couldn't think of anything else. Since the vulnerability only affects the oauth implementation for the connection with Microsoft accounts. Previously the title was "Microsoft OAuth token leak via open redirect in Harvest App" but later I changed it to "Microsoft Account's OAuth tokens leaking via open redirect in Harvest App". I am still considering to change it and open to suggestions.

Looks pretty neat.