Microsoft Account's OAuth tokens leaking via open redirect in Harvest

Re:Microsoft Account's OAuth tokens leaking via open redirec... by nurple on Sunday October 22, 2023 @12:55PM (#37977001)

If only tokens minted by MS were in scope of the vulnerability because of Harvest's outlook integration, maybe something like "Harvest OAuth CSRF Leaks Tokens of Microsoft Outlook Users" or "CSRF in Harvest's Outlook Integration Leaks User Tokens".

If you want to add any editorializing around mitigation, linking to the OAuth RFC[0] that dictates a MUST for binding the users auth state with the request to prevent such attacks would be instructive to readers.

[0] https://datatracker.ietf.org/doc/html/rfc6749#section-10.12

[ Parent | on HN ]

Re:Microsoft Account's OAuth tokens leaking via open redirec... by 0xcrypto on Sunday October 22, 2023 @12:58PM (#37977035)

Oh yes, that sounds better. I am changing the title now.

Updated to "Leaking OAuth tokens of connected Microsoft accounts via open redirect in Harvest"

[ Parent | on HN ]

Re:Microsoft Account's OAuth tokens leaking via open redirec... by dang on Sunday October 22, 2023 @03:21PM (#37978256)

Ok, I've updated the title above to that (shortened a bit to fit HN's 80 char limit). Thanks!

(Submitted title was "Microsoft Account's OAuth tokens leaking via open redirect in Harvest")

[ Parent | on HN ]