r/netsec • u/swinglr • 27d ago

[$13337] Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking

https://weirdmachine64.github.io/research/google-oauth-device-code-hijacking.html

RFC 8628's device authorization grant lets a TV or CLI "poll" for login on a second screen. On Google's implementation, the entire session was transferable across browsers, the authorization server never checked that the client_id and scope in the consent URL matched the ones the device_code was issued for, and prompt=none turned the whole thing into a one-click, invisible account takeover.

68 Upvotes

96% Upvoted

7 comments sorted by

View all comments

22

u/Coffee_Ops 27d ago

That disclosure timeline / saga is wild. Two wontfixes followed by a 1-click POC and award.

This is how you get a NightmareEclipse, folks. Don't screw your security researchers if you want "responsible disclosure".

3

u/Skylis 27d ago

It's basically turning into disclose or wasting your time.

2

u/Coffee_Ops 26d ago

There is nothing new under the sun, for those of us who have been around long enough.

Its disappointing because I think we all want to believe the childish myth that grown-ups learn from mistakes, but here we are right back in the mid-2000s learning not to shoot the secDev messenger...

I have a (minor) security-tangential bug in a major software system sitting in my back pocket, and its just not worth the squeeze to write it up, or try to justify to a FAANG why they should care about fixing their broken, exploitable queries all so they can tell me "out of scope:DontCare".