Frühere Suchanfragen
Suchoptionen
[Blog Post] Unauthenticated #XSS to ATO using #SSO Gadget Chain
Just blogged about a vulnerability chain I recently discovered in a private bug bounty program:
https://security.lauritz-holtmann.de/post/csti-xss-sso-gadget-chain/
TL;DR: If you encounter an SSO implementation, make sure to test the /callback endpoint for XSS within the OAuth/OIDC "error_description" parameter.
Always try to escalate "non-exploitable" XSS-vulns (Self-XSS, only possible when user has no active session, …) using SSO gadgets.
security.lauritz-holtmann.deSSO Gadgets II: Unauthenticated Client-Side Template Injection to Account Takeover using SSO Gadget ChainThe following unauthenticated Client-Side Template Injection (CSTI) resulting in a Cross-Site Scripting (XSS) vulnerability was discovered in a private bug bounty program. While the vulnerability could only be exploited in case a user had no active session at the application, chained with an SSO gadget, a malicious actor could have still gained access to the user’s account and performed actions on behalf of the user.