Recent content on (Web-)Insecurity Blog
The List-Unsubscribe SMTP header is standardized but often overlooked during security assessments. It allows email clients to provide an easy way for end-users to unsubscribe from mailing lists. This post discusses how this header can be abused to perform Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) attacks in certain scenarios. Real-world examples involving Horde Webmail (…
Gerne unterstütze ich Sie als Freelancer bei der Erarbeitung und Durchführung maßgeschneiderter Workshops und Trainings:
Dead Domains are an often overlooked, yet impactful bug class that can lead to significant security vulnerabilities, including Cross-Site Scripting, Information Disclosure, and even Remote Code Execution. Attackers can exploit these vulnerabilities by registering expired or unregistered domains that were previously owned by legitimate entities. But: How can security researchers and penetration…
Research is a constant process of failure and iteration. However, in most cases, you only see the one-in-a-thousand (successful) attempt. To normalize f*ck ups, and because I believe the behavior we identified in the course of this research is still relevant and interesting, this post is published for educational purposes. Implementing secure Single-Sign-On (SSO) flows on mobile platforms is a…
Recently, Tools for Humanity partnered with the German HackerOne Club to run a one-week virtual and in-person Hacking Meetup . In the course of the meetup, a critical vulnerability within the Sign-in with World ID implementation was found, which affected the OpenID Connect form_post Response Mode and could allow malicious actors to take over end-user accounts at third-party applications that…
In 2020, a blog post was published here about the real-world security implications of a vague specification of the Redirect URI within the OAuth 2.0 RFC 1 . At that time, I focussed on redirect-based flows . This post uncovers additional protocol-level issues that lead to security vulnerabilities in popular and well-audited SSO implementations such as Authentik (CVE-2024-21637), Keycloak…
The following unauthenticated Client-Side Template Injection (CSTI) resulting in a Cross-Site Scripting (XSS) vulnerability was discovered in a private bug bounty program. While the vulnerability could only be exploited in case a user had no active session at the application, chained with an SSO gadget , a malicious actor could have still gained access to the user’s account and performed…
With the rise of Single-Sign-On (SSO) and especially OAuth 2.0 and OpenID Connect (OIDC) , the attack surface of web applications has increased significantly. In this post, I will show how to escalate a Cross-Site Scripting (XSS) vulnerability to an Account Takeover (ATO) by abusing OAuth2/OIDC gadgets and how to prevent such attacks.
Ein “Hacker” hat Sie kontaktiert um vermeintliche Sicherheitslücken zu melden? Das hat wahrscheinlich schon jeder, der eine Webseite betreibt, einmal erlebt. Doch was bedeutet das nun für Sie und Ihr Unternehmen? Welche Schritte sollten Sie kurz- und langfristig ergreifen?
Gerne unterstütze ich Sie als Freelancer auf dem Weg zu sichereren Anwendungen und besserem Schutz Ihrer Kundendaten.
This post gives an insight into a sensitive data exposure vulnerability in Asana for Mac that was rated as P1 and was awarded a bounty. This was the very first report of that kind for me. Still, I think this type of deployment and build chain issue is more common than one may think.
Hi there 👋 My name is Lauritz and I am an IT-Security researcher and penetration tester based in Germany. This is my personal website where I publish thoughts and advisories about my research. You can find me on various bug bounty platforms: Hackerone Intigriti Bugcrowd YesWeHack Since 2024, I am also a Hackerone Brand Ambassador and I am happy to help you with any questions you might have about…
This post gives a deep dive into a critical security flaw that was present in Flickr ’s login flow. The authentication at identity.flickr.com is implemented using AWS Cognito . By exploiting configuration issues and violations of the OpenID Connect specification, it was possible to takeover any Flickr account without user interaction.
The Auth. Request Analyser (AuRA) Chromium extension aims to support the analysis of OAuth and OpenID Connect implementations, by offering semi-automated analysis and attack capabilities for Authorization/Authentication Requests .
During my master’s thesis, I created custom OpenID Connect Service Provider (SP) and Identity Provider (IdP) implementations for research and Proof-of-Concept purposes. Both implementations use NodeJS . This post outlines their capabilities and how they can be extended.
In this post, I will discuss an OAuth 2.0 and OpenID Connect 1.0 implementation flaw pattern that was or is present even in well-known implementations from Github , Stackoverflow and Microsoft .
This is a post about a Cross-Site-Scripting (XSS) vulnerability that was identified within the web version of a large Chinese messenger and payment platform. The vulnerability could have been missed easily, as the vulnerable parameter was manually guessed.
The following (slightly modified) vulnerability report was sent to TikTok using Hackerone on 17th October 2020 and was resolved within 12 days.
This is the final post of a series on Single Sign-On and OpenID Connect 1.0 security. In this post, Responsible Disclosure processes with five vendors and maintainers of popular OpenID Connect implementations are outlined. We reported vulnerabilities and security issues in Amazon Cognito , Bitbucket Server , GitLab , Keycloak , and Salesforce .
This is the sixth post of a series on Single Sign-On and OpenID Connect 1.0 security. This post outlines how the missing requirement of the state value within the OpenID Connect Core specification leads to real-life security issues. Namely, the Denial-of-Service Amplification attack is introduced with CVE-2020-14302 ( Keycloak ) as an example.
This is the fifth post of a series on Single Sign-On and OpenID Connect 1.0 security. This post outlines how the vague specification of the Redirect URI within the OpenID Connect Core specification leads to real-life security issues. Finally, we show a real-world example of such an issue with CVE-2020-10776 ( Keycloak ) as an example.
This is the fourth post of a series on Single Sign-On and OpenID Connect 1.0 security. In this post, SSRF vulnerabilities that were discovered in popular OIDC implementations ( Keycloak ( CVE-2020-10770 ) and Amazon Cognito ) are explained in detail.
This is the third post of a series on Single Sign-On and OpenID Connect 1.0 security. In this post, a more common CRLF injection in the context of OIDC is discussed in detail. We present issues discovered in GitLab (Severity: High - Critical) and Bitbucket Server (Severity: Informative - Low).
This is the second post of a series on Single Sign-On and OpenID Connect 1.0 security. In this post, the novel Login Confusion attack is described in detail. We use Bitbucket Server as an example.
The following (slightly modified) advisory was sent to GitLab using Hackerone on 19th June 2020.
This is the first post of a series on Single Sign-On and OpenID Connect 1.0 security. This post presents a high-level overview of observed issue patterns during my research on real-life OIDC security and proposes additions to the specification’s security considerations.
The following (slightly modified) advisory regarding macOS 10.15.6. (Catalina) was sent to Apple Product Security on 25th August 2020.
This is the very first actual “blog post” on this site. As the main structure might indicate, future content will be categorized either as dedicated advisory on an observed vulnerability or as blog post on more high-level observations.
When I set up this blog, privacy and security were key reasons for choosing a static site generator, namely the awesome Hugo framework: https://gohugo.io/ . Thus, https://security.lauritz-holtmann.de does not set cookies nor aims to track you on application level. Hosting & Logging (Hetzner) This website is hosted by Hetzner Online GmbH . The web server configuration avoids creating unnecessary…
The following (slightly modified) advisory was sent to the TYPO3 security team ( security@typo3.org ) on 28th January 2019.
Angaben gemäß § 5 TMG Lauritz Holtmann Südring 25 44787 Bochum Umsatzsteuer-Identifikationsnummer USt-IdNr: DE453537805 Vertreten durch: Lauritz Holtmann Kontakt: E-Mail: security@lauritz-holtmann.de Haftungsausschluss: Haftung für Inhalte Die Inhalte unserer Seiten wurden mit größter Sorgfalt erstellt. Für die Richtigkeit, Vollständigkeit und Aktualität der Inhalte können wir jedoch keine Gewähr…