Hacker News new | past | comments | ask | show | jobs | submit login

A quite common error, actually. Lots and lots of services are configured to accept logins from arbitrary auths, but forget to verify that it's an auth they actually trust! You just check that it's a valid oauth token, and your code works for your login page, so you consider your login-feature to be done and move on to something else, leaving a wide open door.

Edit: As the article itself stated, around 25% of all systems with this setup are vulnerable!

> The results surprised us: 25% of all the multi-tenant apps we scanned were vulnerable to authentication bypass.




I need to update my hacker fantasy about systems intrusion from complicated multi-stage takeover to "just log in"


> just log in

If only. How about: just download the backup of the server log from https://example.com/logfile.txt? Oh, and it contains everything. Including internal application logs.


And sometimes they fail 'open' so when the auth provider goes down all authentication evaporates and you have access to everything.


Fail open can be the right choice for some applications. Especially if you have logging of user credentials.


Btw, even single-tenant can be a bit scary in this regard: You can by default log in with guest users. For instance if someone has joined a teams meeting. So unless you explicitly check permissions or disable this (for instance if you think "everyone in our org should have access to this"), you inadvertently could have external people log into your apps as well.


Tutorial on how to deny Guest users in Azure AD[1]

In general, one should always use roles in Azure. Even if you have a flaw like this, your endpoint would be safe if you required a role to access your endpoint.

For multi-tenants, I completely this misconfiguration, there’s no real warnings when configuring it. In order to lock down to specific tenants, I recommend having a list of issuers that you check the token against.[2]

[1] https://intility.github.io/fastapi-azure-auth/single-tenant/...

[2] https://intility.github.io/fastapi-azure-auth/multi-tenant/a...


Microsoft should never have offered an API to verify an auth token is syntactically valid without checking who it is.


That's not the problem. They do check identity. The problem i the application that accepts Azure's verification as authentication and authorization.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: