19 September 2023
OAuth 2.0 Redirect URI Validation Falls Short Literally
Annual Computer Security Applications Conference (ACSAC)
OAuth 2.0 requires a complex redirection trail between websites and Identity Providers (IdPs). In particular, the "redirect URI" parameter included in the popular Authorization Grant Code flow governs the callback endpoint that users are routed to, together with their security tokens. The protocol specification, therefore, includes guidelines on protecting the integrity of the redirect URI. In this work, we analyze the OAuth 2.0 specification in light of modern systems-centric attacks and reveal that the prescribed redirect URI validation guidance exposes IdPs to path confusion and parameter pollution attacks. Based on this observation, we propose novel attack techniques and experiment with 16 popular IdPs, empirically verifying that the OAuth 2.0 security guidance is under-specified. We finally present end-to-end attack scenarios that combine our attack techniques with common web application vulnerabilities, ultimately resulting in a complete compromise of the secure delegated access that OAuth 2.0 promises.
citation
@inproceedings{10.1145/3627106.3627140,
author = {Innocenti, Tommaso and Golinelli, Matteo and Onarlioglu, Kaan and Mirheidari, Ali and Crispo, Bruno and Kirda, Engin},
title = {OAuth 2.0 Redirect URI Validation Falls Short, Literally},
year = {2023},
isbn = {9798400708862},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3627106.3627140},
doi = {10.1145/3627106.3627140},
abstract = {OAuth 2.0 requires a complex redirection trail between websites and Identity Providers (IdPs). In particular, the "redirect URI" parameter included in the popular Authorization Grant Code flow governs the callback endpoint that users are routed to, together with their security tokens. The protocol specification, therefore, includes guidelines on protecting the integrity of the redirect URI. In this work, we analyze the OAuth 2.0 specification in light of modern systems-centric attacks and reveal that the prescribed redirect URI validation guidance exposes IdPs to path confusion and parameter pollution attacks. Based on this observation, we propose novel attack techniques and experiment with 16 popular IdPs, empirically verifying that the OAuth 2.0 security guidance is under-specified. We finally present end-to-end attack scenarios that combine our attack techniques with common web application vulnerabilities, ultimately resulting in a complete compromise of the secure delegated access that OAuth 2.0 promises.},
booktitle = {Proceedings of the 39th Annual Computer Security Applications Conference},
pages = {256–267},
numpages = {12},
keywords = {OAuth 2.0, parameter pollution, account takeover, redirect URI, path confusion},
location = {<conf-loc>, <city>Austin</city>, <state>TX</state>, <country>USA</country>, </conf-loc>},
series = {ACSAC '23}
}