Tencent QQ OAuth 2.0 Service Covert Redirect Web Security Bugs (Information Leakage & Open Redirect)
(1) Domain:
qq.com
“Tencent QQ, popularly known as QQ, is an instant messaging software
service developed by Chinese company Tencent Holdings Limited. QQ also
offers a variety of services, including online social games, music,
shopping, microblogging, movies, platform of games and group and voice
chat. As of January 2015, there are 829 million active QQ accounts, with
a peak of 176.4 million simultaneous online QQ users." (Wikipedia)
(2) Vulnerability Description:
Tencent QQ web application has a computer security problem. Hacker can exploit it by Covert Redirect cyber attacks.
The vulnerabilities can be attacked without user login. Tests were
performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla
Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064
(64-bit) of Ubuntu (14.04)，Apple Safari 6.1.6 of Mac OS X Lion 10.7.
(2.1) Vulnerability Detail:
QQ’s SSO system is susceptible to
Attacks. More specifically, the authentication of parameter
“&redirct_uri" in SSO system is insufficient. It can be misused to
design Open Redirect Attacks to QQ.
At the same time, it can be used to
collect sensitive information of both third-party app and users by using
the following parameters (sensitive information is contained in HTTP
header.),
“&response_type"=sensitive_info,token…
“&scope"=get_user_info%2Cadd_share…
It increases the likelihood of successful Open Redirect Attacks to third-party websites, too.
The vulnerabilities occurs at page “/oauth/show?" with parameter “&redirect_uri", e.g.
http://openapi.qzone.qq.com/oauth/show?which=ConfirmPage&display=pc&client_id=100261282&redirect_uri=http%3A%2F%2Fuc.cjcp.com.cn%2Findex.php%3Fm%3DUser%26a%3Dcallback%26type%3Dqq&response_type=code&scope=get_user_info%2Cadd_share [1]
Before acceptance of third-party application:
When a logged-in QQ user clicks the
URL ([1]) above, he/she will be asked for consent as in whether to allow
a third-party website to receive his/her information. If the user
clicks OK, he/she will be then redirected to the URL assigned to the
parameter “&redirect_uri".
If a user has not logged onto QQ and clicks the URL ([1]) above, the same situation will happen upon login.
After acceptance of third-party application:
A logged-in QQ user would no longer
be asked for consent and could be redirected to a webpage controlled by
the attacker when he/she clicks the URL ([1]).
For a user who has not logged in, the attack could still be completed after a pop-up page that prompts him/her to log in.
(2.1.1) QQ would normally
allow all the URLs that belong to the domain of an authorized
third-party website. However, these URLs could be prone to manipulation.
For example, the “&redirect_uri" parameter in the URLs is supposed
to be set by the third-party websites, but an attacker could change its
value to make Attacks.
Hence, a user could be redirected
from QQ to a vulnerable URL in that domain first and later be redirected
from this vulnerable site to a malicious site unwillingly. This is as
if the user is redirected from QQ directly. The number of QQ’s SSO
client websites is so huge that such Attacks could be commonplace.
Before acceptance of the third-party
application, QQ’s SSO system makes the redirects appear more
trustworthy and could potentially increase the likelihood of successful
Open Redirect Attacks of third-party website.
Once the user accepts the application, the attackers could completely bypass QQ’s authentication system and attack more easily.
Used one of webpages for the following tests. The webpage is “
https://dailymem.wordpress.com/“. Can suppose it is malicious and contains code that collect sensitive information of both third-party app and users.
Below is an example of a vulnerable third-party domain:
cjcp.com.cn
Vulnerable URL in this domain:
http://uc.cjcp.com.cn/?m=user&a=otherLogin&type=qq&furl=http%3A%2F%2Ftetraph.com%2Fessayjeans%2Fseasons%2F%25E7%25A2%258E%25E5%25A4%258F.html
Vulnerable URL from QQ that is related to cjcp.com.cn:
http://openapi.qzone.qq.com/oauth/show?which=Login&display=pc&client_id=100261282&redirect_uri=http%3A%2F%2Fuc.cjcp.com.cn%2Findex.php%3Fm%3DUser%26a%3Dcallback%26type%3Dqq&response_type=code&scope=get_user_info%2Cadd_share
POC:
http://openapi.qzone.qq.com/oauth/show?which=Login&display=pc&client_id=100261282&redirect_uri=http%3A%2F%2Fuc.cjcp.com.cn%2F%3Fm%3Duser%26a%3DotherLogin%26type%3Dqq%26furl%3Dhttp%253A%252F%252Ftetraph.com%252Fessayjeans%252Fseasons%252F%2525E7%2525A2%25258E%2525E5%2525A4%25258F.html&response_type=code&scope=get_user_info%2Cadd_share [2]
(2.2) Another method for attackers.
Attackers enter the following URL in browser,
http://uc.cjcp.com.cn/?m=user&a=otherLogin&type=qq&furl=http%3A%2F%2Ftetraph.com%2Fessayjeans%2Fseasons%2F%25E7%25A2%258E%25E5%25A4%258F.html
Then, attackers can get URL below,
http://openapi.qzone.qq.com/oauth/show?which=Login&display=pc&client_id=100261282&redirect_uri=http%3A%2F%2Fuc.cjcp.com.cn%2Findex.php%3Fm%3DUser%26a%3Dcallback%26type%3Dqq&response_type=code&scope=get_user_info%2Cadd_share [3]
If users click URL [3], the same thing will happen as URL [2].
(2.3) The following URLs have the same vulnerabilities.
http://openapi.qzone.qq.com/oauth/qzoneoauth_authorize?oauth_consumer_key=209717&oauth_token=14921471022138330625&oauth_callback=http://user.nipic.com/api/login/qq/callback.asp
https://graph.qq.com/oauth2.0/authorize?client_id=100246654&redirect_uri=http://youxi.baidu.com/tp/QQAuth.jsp&response_type=code
https://open.t.qq.com/cgi-bin/oauth2/authorize?client_id=801132217&response_type=code&redirect_uri=http://passport.tianya.cn/login/txwb.do
POC Video:
https://www.youtube.com/watch?v=-lxaX9xvUfE
Blog Detail:
http://tetraph.blogspot.com/2014/05/tencent-qq-oauth-20-covert-redirect.html
(3) What is Covert Redirect?
Covert Redirect is a class of security bugs disclosed in May 2014. It is an application that takes a parameter
and
redirects a user to the parameter value without sufficient validation.
This often makes use of Open Redirect and XSS (Cross-site Scripting)
vulnerabilities in third-party applications.
Covert Redirect is also related to single sign-on, such as OAuth
and OpenID
. Hacker may use it to steal users’ sensitive information.
Almost all
OAuth 2.0 and OpenID providers worldwide are affected. Covert Redirect
can work together with CSRF (Cross-site Request Forgery) as well.
Discover and Reporter:
Jing Wang, Division of Mathematical Sciences (MAS), School of Physical
and Mathematical Sciences (SPMS), Nanyang Technological University
(NTU), Singapore. (
@justqdjing)
http://tetraph.com/wangjing/
Related Articles:
http://tetraph.com/security/covert-redirect/tencent-qq-oauth-2-0-covert-redirect
https://twitter.com/yangziyou/status/615125849306632193
https://biyiniao.wordpress.com/2014/08/28/qq-bugs/
http://diebiyi.com/articles/security/covert-redirect/tencent-qq-oauth-2-0-covert-redirect
http://frenchairing.blogspot.com/2014/08/tencent-qq-exploit.html
http://tetraph.blog.163.com/blog/static/23460305120144631154854/
http://guyuzui.lofter.com/post/1ccdcda4_6f0b982
http://mathpost.tumblr.com/post/119490927560/itinfotech-id-oauth
http://www.inzeed.com/kaleidoscope/covert-redirect/tencent-qq-oauth-2-0
https://computertechhut.wordpress.com/2014/08/28/tencent-qq-bug/
http://computerobsess.blogspot.com/2014/05/tencent-qq-bug.html
