Skip to content

Instantly share code, notes, and snippets.

@mkropat

mkropat/Attacking-OpenIDConnect.md

Last active November 11, 2021 02:44
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mkropat/51f8116cbf685a1e0dc9fd92c1b8fba7 to your computer and use it in GitHub Desktop.
Save mkropat/51f8116cbf685a1e0dc9fd92c1b8fba7 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Attacking-OpenIDConnect.md

How to exploit vulnerable implementations

  • Doesn't validate signature? → Forge arbitrary JWTs
  • Acts on data in payload before validating signature? → Forge arbitrary JWTs
  • Doesn't validate signature algorithm? → Forge JWT with algorithm "none"
  • Doesn't validate key↔algorithm match? → Create HS256 signature signed with expected public key
  • Doesn't validate audience? → Trick victim to sign in to evil app, then use creds to auth to vulnerable app as victim
  • Doesn't validate issuer? → Use JWT for one tenant to authenticate to a different tenant
  • Doesn't validate nonce? → Replay attack
  • Doesn't validate nonce/state against original sent value? → CSRF
  • Desn't validate URL in state if present and used for redirect? → Send victim a link with state pointing at phishing site
  • Open Reply-URL? → Trick victim to sign in to evil web app, passing audience id for vulnerale app
  • localhost Reply-URL? → Trick victim to sign in to evil desktop app, passing audience id for vulnerable app
  • Secrets stored in unencrypted JWT? → Examine JWT
  • Secret token stored in web storage? → Look for XSS vulnerability
  • Secret token stored in non-HTTP-only cookie → Look for XSS vulnerability

See Also

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment