Security experts have identified a critical vulnerability impacting over one million websites, arising from flaws in OAuth implementations coupled with cross-site scripting (XSS) attacks.
This vulnerability originates from the interplay between OAuth, a commonly used authentication protocol, and XSS, a persistent web security issue. Although XSS attacks have declined due to enhanced security measures, this new exploit shows that combining XSS with OAuth can bypass conventional defenses.
The core problem lies in how OAuth is implemented across various web applications. Attackers can create malicious URLs that mimic legitimate OAuth login requests, intercepting the authentication process to gain unauthorized access to user accounts.
This method enables attackers to circumvent typical XSS defenses, potentially exposing sensitive user information such as names, addresses, emails, banking details, and credentials.
The initial research targeted Hotjar, a widely-used web analytics service among high-profile companies. Despite Hotjar’s strong security measures, researchers discovered that combining XSS with OAuth could result in account takeovers. This vulnerability has now been resolved, highlighting the need for ongoing security monitoring in all web applications.
“Once the attacker obtains a victim’s code, they can initiate a new login flow in Hotjar, substituting their code with the victim’s, leading to complete account control,” noted researchers from Salt Security.
Salt Security has developed a new tool to detect a broad spectrum of vulnerabilities, including those related to APIs, OAuth, and web security.
This discovery has significant implications, affecting websites of major companies like Microsoft, Adobe, Columbia, Panasonic, Decathlon, RyanAir, Nintendo, and T-Mobile. Any site utilizing OAuth for authentication could be vulnerable.
To mitigate this risk, security experts recommend several measures:
- Implement manual input sanitization and output encoding to block unauthorized script execution.
- Use modern web frameworks such as React and Angular, which have built-in XSS protections.
- Set cookies with HTTP-Only attributes to prevent JavaScript access.
- Define and enforce content security policies to restrict sources of executable scripts.
As the cybersecurity landscape evolves, this finding underscores the importance of proactive security measures and the need for developers and security professionals to consider the interactions between different technologies. With millions of websites potentially at risk, addressing this OAuth vulnerability is now a top priority for the web security community.
