Re: [OAUTH-WG] Draft 20 last call comment (Resource Owner Impersonation)

We know how to fix CSRF attacks on form submission which this is. The UI questions about more about legitimate client interaction and how informed a user should be.

EHL

From: William J. Mills [mailto:wmills@yahoo-inc.com]
Sent: Thursday, August 18, 2011 12:27 PM
To: Niv Steingarten; Eran Hammer-Lahav
Cc: oauth@ietf.org
Subject: Re: [OAUTH-WG] Draft 20 last call comment (Resource Owner Impersonation)

This is, in my opinion, another style of CSRF.  I the attacker present your browser (user agent) with a link, and your browser presents a credential automatically to the token endpoint, which automatically issues a token to be given back to me?  That's a classic CSRF, how to fix it is interesting.  I'm of the opinion that the user *should* be pesented with some UI at that point so they can make an informed choice about issuing a credential.  Not everyone agrees with me though (mostly business folks that want to avoid user interaction because it's too scary .... and somehow informing the user what they are doign is a bad thing).

-bill

________________________________
From: Niv Steingarten <nivstein@gmail.com<mailto:nivstein@gmail.com>>
To: Eran Hammer-Lahav <eran@hueniverse.com<mailto:eran@hueniverse.com>>
Cc: "oauth@ietf.org<mailto:oauth@ietf.org>" <oauth@ietf.org<mailto:oauth@ietf.org>>
Sent: Thursday, August 18, 2011 12:11 PM
Subject: Re: [OAUTH-WG] Draft 20 last call comment (Resource Owner Impersonation)

On Thu, Aug 18, 2011 at 21:17, Eran Hammer-Lahav <eran@hueniverse.com<mailto:eran@hueniverse.com>> wrote:
>
>
>> -----Original Message-----
>> From: Niv Steingarten [mailto:nivstein@gmail.com<mailto:nivstein@gmail.com>]
>> Sent: Thursday, August 18, 2011 11:08 AM
>> To: Eran Hammer-Lahav
>> Cc: Torsten Lodderstedt; oauth@ietf.org<mailto:oauth@ietf.org>
>> Subject: Re: [OAUTH-WG] Draft 20 last call comment (Resource Owner
>> Impersonation)
>>
>> On Thu, Aug 18, 2011 at 20:31, Eran Hammer-Lahav <eran@hueniverse.com<mailto:eran@hueniverse.com>>
>> wrote:
>> >
>> >
>> >> -----Original Message-----
>> >> From: Niv Steingarten [mailto:nivstein@gmail.com<mailto:nivstein@gmail.com>]
>> >> Sent: Thursday, August 18, 2011 10:16 AM
>> >> To: Eran Hammer-Lahav
>> >> Cc: Torsten Lodderstedt; oauth@ietf.org<mailto:oauth@ietf.org>
>> >> Subject: Re: [OAUTH-WG] Draft 20 last call comment (Resource Owner
>> >> Impersonation)
>> >>
>> > Can you provide another example with the same level of detail as you
>> provided below?
>>
>> The malicious client sends a request to the authorization endpoint with the
>> appropriate parameters, and in return receives the markup of the web-page
>> which should be displayed to the user in order to get consent. In addition,
>> since the request is launched not via a sandboxed user-agent, the client also
>> has access to any 'Set-Cookie'
>> HTTP headers.
>>
>> Instead of displaying the page to the user, the client extracts the web-form
>> data (including the hidden nonce/token) which would be submitted when
>> 'Allow' is clicked. It then forges the appropriate POST request with the
>> cookies, form data and referrer, and dispatches it,
>
> SCENE MISSING [1]
>
>> to finally receive an access token/authorization code in the redirection.
>
> You skipped the best part!
>
> What do you mean by "dispatches it"? How is the resource owner tricked or abused to grant authorization unknowingly? I understand how your proposal "fixes" the first half, but not what kind of attack is happening in the second half.
>

I might have accidentally skipped the part where the user is already
logged in at the authorization endpoint, so no log-in is required but
rather just allowing/denying access (correction: the first request is
sent using an HTTP framework/WebKit, so no access to cookies). Once it
extracts the data from the web-form, the client has all the
information it needs in order to create an HTTP request and launch it
using the same HTTP framework/WebKit, simulating the "Allow" button.

>
> [1] http://www.ibras.dk/montypython/episode34.htm
>

+1 for more Monty Python references.

-- Niv
_______________________________________________
OAuth mailing list
OAuth@ietf.org<mailto:OAuth@ietf.org>
https://www.ietf.org/mailman/listinfo/oauth