header banner
Default

Important OAuth Vulnerabilities Found in Grammarly, Vidio, and Bukalapak Platforms


Table of Contents

    Critical security flaws have been disclosed in the Open Authorization (OAuth) implementation of popular online services such as Grammarly, Vidio, and Bukalapak, building upon previous shortcomings uncovered in Booking[.]com and Expo.

    The weaknesses, now addressed by the respective companies following responsible disclosure between February and April 2023, could have allowed malicious actors to obtain access tokens and potentially hijack user accounts.

    OAuth is a standard that's commonly used as a mechanism for cross-application access, granting websites or applications access to their information on other websites, such as Facebook, but without giving them the passwords.

    "When OAuth is used to provide service authentication, any security breach in it can lead to identity theft, financial fraud, and access to various personal information including credit card numbers, private messages, health records, and more, depending on the specific service being attacked," Salt Security researcher Aviad Carmel said.

    The problem identified in Vidio stems from an absence of token verification, meaning an attacker can use an access token generated for another App ID, a random identifier created by Facebook for every application or website that gets registered in its developer portal.

    In a potential attack scenario, a threat actor could create a rogue website that offers a sign-in option through Facebook to collect the access tokens and subsequently use them against Vidio.com (which has the App ID 92356), thereby allowing full account takeover.

    The API security firm said it also discovered a similar issue with token verification on Bukalapak.com via Facebook login that could result in unauthorized account access.

    On Grammarly, it emerged that when users attempt to login to their accounts using the "Sign in with Facebook" option, an HTTP POST request is sent to auth.grammarly[.]com to authenticate them using a secret code.

    As a result, while Grammarly is not susceptible to a token reuse attack like in the case of Vidio and Bukalapak, it is nonetheless vulnerable to a different kind of problem wherein the POST request can be altered to substitute the secret code with an access token obtained from the aforementioned malicious website to gain access to the account.

    "And like with the other sites, the Grammarly implementation did not perform token verification," Carmel said, adding, "an account takeover would give an attacker access to the victim's stored documents."

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

    Sources


    Article information

    Author: Brian Wood

    Last Updated: 1698911762

    Views: 1775

    Rating: 4.1 / 5 (105 voted)

    Reviews: 88% of readers found this page helpful

    Author information

    Name: Brian Wood

    Birthday: 2013-11-12

    Address: 9357 Chase Forge Suite 020, Emmaside, CT 42279

    Phone: +4358755469619756

    Job: Biologist

    Hobby: Graphic Design, Wildlife Photography, Juggling, Backpacking, Arduino, Running, Skateboarding

    Introduction: My name is Brian Wood, I am a venturesome, ingenious, radiant, Gifted, priceless, accomplished, fearless person who loves writing and wants to share my knowledge and understanding with you.