1765917 - Open Redirection when using OAuth2 for authentication

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect)

Description

[<%= 7*7 %>]

Open Redirection on https://bugzilla.mozilla.org

Users can be redirected to a malicious site:

POC: https://bugzilla.mozilla.org/oauth/authorize?client_id=46ZcfPbH815zhnmUeyBw&scope=user%3Aread&redirect_uri=https%3A%2F%2Fbing.com&state=8bd3299c19271dfe661baf0e21d4c26aaaa0101f&response_type=code

or

POC: https://bugzilla.mozilla.org/oauth/authorize?client_id=46ZcfPbH815zhnmUeyBw&scope=user%3Aread&redirect_uri=https%3A%2F%2Fbing.com%2Fauth%2Flogin%2Fbmo%3Abugzilla.mozilla.org%2F&state=8bd3299c19271dfe661baf0e21d4c26aaaa0101f&response_type=code

after successful login, the user can be redirected to malicious website.

I hope you know the impact of open redirect and for more info refer

https://cwe.mitre.org/data/definitions/601.html

Impact:
Users can be redirected to malicious sites.

Comment 1

[Frida K [:frida]]

Hello,

Thank you for your report.

I am not able to reproduce the issue. I get 404 not found error and the response also has an error parameter equals to invalid_redirect_uri as you can see from the screenshot.

Thanks,
Frida

Comment 2

[Frida K [:frida]]

Attachment: PoC results in error

Comment 3

[<%= 7*7 %>]

Attachment: OP.mp4

Comment 4

[<%= 7*7 %>]

why did you close this report frida?
There is no bounty for Open redirection but I want to secure Mozilla that's why I submitted Open redirect but you close this report suddenly without asking anything from a reporter? its too unfair

Comment 5

[Frida K [:frida]]

Please submit additional evidence and detailed steps in reproduce in text (we do not prefer video attachments) and I'll happily reopen the bug if it is indeed valid.

Thanks,
Frida

Comment 6

[<%= 7*7 %>]

step to reproduce:
copy the link and paste it into a new tab: https://bugzilla.mozilla.org/oauth/authorize?client_id=46ZcfPbH815zhnmUeyBw&scope=user%3Aread&redirect_uri=https%3A%2F%2Fbing.com&state=8bd3299c19271dfe661baf0e21d4c26aaaa0101f&response_type=code

redirect_uri parameter is vulnerable to open redirection.

redirect_uri=https%3A%2F%2Fbing.com
redirect_uri=https%3A%2F%2Fgoogle.com

Comment 7

[<%= 7*7 %>]

(In reply to Boopathi from comment #6)

step to reproduce:
copy the link and paste it into a new tab: https://bugzilla.mozilla.org/oauth/authorize?client_id=46ZcfPbH815zhnmUeyBw&scope=user%3Aread&redirect_uri=https%3A%2F%2Fbing.com&state=8bd3299c19271dfe661baf0e21d4c26aaaa0101f&response_type=code

redirect_uri parameter is vulnerable to open redirection.

if you open a new tab it will ask for login credentials for Bugzilla
while you give valid credentials after login it will be redirected to bing.com

Comment 8

[Frida K [:frida]]

I

Comment 9

[Frida K [:frida]]

Hello,

I can see the redirection now, when I used a valid state parameter, I was redirected to the error page since redirect_uri parameter is being validated. However, when submitting the request with an invalid state parameter or without the parameter, I am being redirected.

for example:

https://bugzilla.mozilla.org/oauth/authorize?client_id=46ZcfPbH815zhnmUeyBw&scope=user%3Aread&redirect_uri=https://duckduckgo.com

redirects to:

https://duckduckgo.com/?error=access_denied&error_description=resource+owner+denied+access

I have reopened and assigned the report.

Thanks,
Frida

Comment 10

[Frida K [:frida]]

Hello David,

Can you please take a look at this report?

Thanks,
Frida

Comment 11

[<%= 7*7 %>]

Hi team, any updates?

Comment 12

[Frida K [:frida]]

The team are aware of the bug and they are working on it. We will post updates here when we know more info.

Comment 13

[David Lawrence [:dkl]]

Attachment: GitHub Pull Request

Comment 14

[David Lawrence [:dkl]]

Merged to master and deploying fix today.
https://github.com/mozilla-bteam/bmo/commit/c93b0357f02fde3c485f54c9ebe5c94daa9c4446

Comment 15

[David Lawrence [:dkl]]

The fix for this bug is now live in production. Please verify that this is fixed for you.

Comment 16

[<%= 7*7 %>]

This is a Confirmation that the Open Redirect was not happening, I tested it, and it's not working anymore. I appreciate your excellent job!!!!

Comment 17

[<%= 7*7 %>]

Hi David,

There is no HOF or Bounty in this report? Could you please check and confirm at the earliest.

Comment 18

[Frida K [:frida]]

Hello Boopathi,

Thank you for confirming the fix. We will discuss the report in the coming couple of weeks and let you know our decision.

Thanks,
Frida

Comment 19

[<%= 7*7 %>]

Thanks, Frida
I hope good news comes from you.

Comment 20

[<%= 7*7 %>]

Thank you for confirming the fix. We will discuss the report in a coming couple of weeks and let you know our decision.

Hi Frida,
Any updates?

Comment 21

[<%= 7*7 %>]

Hi Frida,
You raised a "PTO" due on 11th May but I didn't get any updates, could you please check and let me know...

Comment 22

[Frida K [:frida]]

we will let you know of our decision once we have a chance to discuss the report, you don't have to keep requesting for updates. Please note that we have not forgotten this ticket, we have a tracking system and a review cadence that will ensure that all potentially bounty eligible reports get reviewed and acted on.

Please refer to our contribution guidelines before commenting or sending private emails: https://bugzilla.mozilla.org/page.cgi?id=etiquette.html.

Thanks,
Frida

Comment 23

[Daniel Veditz [:dveditz]]

We are awarding a Hall of Fame entry for this bug report. Thank you!

Comment 24

[<%= 7*7 %>]

Yeah but it's not a normal open redirect, it's an Oauth2 open redirection, you can steal the victim's cookies and take over his/her account,

Comment 25

[<%= 7*7 %>]

For Your Perusal I've attached a reference please take look and do the needful.
https://hackerone.com/reports/55525
https://hackerone.com/reports/665651

Comment 26

[Frida K [:frida]]

Hello Boopathi,

We already received a report regarding the Oauth authentication and it is not possible to take over the user's account in our case because we perform validation on the redirect_uri in both Bugzilla and Phabricator. Please refer to bug 1761594 for details.

Thanks,
Frida