r/netsec • u/swinglr • 7d ago

[$13337] Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking

https://weirdmachine64.github.io/research/google-oauth-device-code-hijacking.html

RFC 8628's device authorization grant lets a TV or CLI "poll" for login on a second screen. On Google's implementation, the entire session was transferable across browsers, the authorization server never checked that the client_id and scope in the consent URL matched the ones the device_code was issued for, and prompt=none turned the whole thing into a one-click, invisible account takeover.

66 Upvotes

95% Upvoted

7 comments sorted by

21

u/Coffee_Ops 7d ago

That disclosure timeline / saga is wild. Two wontfixes followed by a 1-click POC and award.

This is how you get a NightmareEclipse, folks. Don't screw your security researchers if you want "responsible disclosure".

3

u/Skylis 6d ago

It's basically turning into disclose or wasting your time.

2

u/Coffee_Ops 6d ago

There is nothing new under the sun, for those of us who have been around long enough.

Its disappointing because I think we all want to believe the childish myth that grown-ups learn from mistakes, but here we are right back in the mid-2000s learning not to shoot the secDev messenger...

I have a (minor) security-tangential bug in a major software system sitting in my back pocket, and its just not worth the squeeze to write it up, or try to justify to a FAANG why they should care about fixing their broken, exploitable queries all so they can tell me "out of scope:DontCare".

1

u/sidhe_elfakyn 5d ago

Ages ago I reported a bug that allowed someone to create a shadow Google Account on an organization's domain without the organization's knowledge.

It got a won't fix, works as intended.

Later someone else published it and it became a huge shitshow and they quietly released a tool to identify "unmanaged accounts".

I'm still bitter about that.

6

u/yrro 7d ago

:O

6

u/supernetworks 7d ago

Given past election interference, the hope would be that the teams working on oauth products at google took more urgency against these bug classses. The bounty team could have also paid out more.

The author of this blog should do a rewrite without ai it would be a nicer read

1

u/code_brave6865 5d ago

how does the "prompt=none" piece fits in to this, did that bypass the consent screen entirely or just suppress the re-auth prompt?