CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Open Redirect Web Security Vulnerability

Exploit Title: “Ping Identity Corporation” “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Web Security Vulnerability

Product: PingFederate 6.10.1 SP Endpoints

Vendor: Ping Identity Corporation

Vulnerable Versions: 6.10.1

Tested Version: 6.10.1

Advisory Publication: November 27, 2014

Latest Update: December 16, 2014

Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]

CVE Reference: CVE-2014-8489

mpact CVSS Severity (version 2.0):
CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 10.0
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification

Author and Writer: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

  

Introduction Details

(1) Vendor & Product Description:


Vendor:
Ping Identity


Product & Vulnerable Versions:
PingFederate 
6.10.1 


Vendor URL & Download:
PingFederate 6.10.1  can be gained from here,
http://documentation.pingidentity.com/display/PF66/Service+Provider+Integration



Product Introduction Overview:

"An SP is the consumer of identity attributes provided by the IdP through a SAML assertion. SP integration involves passing the identity attributes from PingFederate to the target SP application. The SP application uses this information to set a valid session or other security context for the user represented by the identity attributes. Session creation can involve a number of approaches, and as for the IdP, Ping Identity offers commercial integration kits that address the various SP scenarios. Most SP scenarios involve custom-application integration, server-agent integration, integration with an IdM product, or integration with a commercial application.

 Custom Applications: many applications use their own authentication mechanisms, typically through a database or LDAP repository, and are responsible for their own user-session management. Custom-application integration is necessary when there is limited or no access to the Web or application server hosting the application. Integration with these custom applications is handled through application-level integration kits, which allow software developers to integrate their applications with a PingFederate server acting as an SP.

With these integration kits, PingFederate sends the identity attributes from the SAML assertion to the SP application, which can then use them for its own authentication and session management. As for the IdP, application-specific integration kits include an SP agent, which resides with the SP application and provides a simple programming interface to extract the identity attributes sent from the PingFederate server. The information can be used to start a session for the SP application.

Ping Identity provides custom-application integration kits for a variety of programming environments, including: Java, .NET, PHP.

In addition, Ping Identity provides an Agentless Integration Kit, which allows developers to use direct HTTP calls to the PingFederate server to temporarily store and retrieve user attributes securely, eliminating the need for an agent interface."

(2) Vulnerability Details:

PingFederate 6.10.1 SP Endpoints web application has a computer security bug problem. It can be exploited by Unvalidated Redirects and Forwards (URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

Other similar products 0day vulnerabilities have been found by some other bug hunter researchers before. PingFederate has patched some of them. Web Security Watch is an aggregator of security reports coming from various sources. It aims to provide a single point of tracking for all publicly disclosed security issues that matter. "Its unique tagging system enables you to see a relevant set of tags associated with each security alert for a quick overview of the affected products. What's more, you can now subscribe to an RSS feed containing the specific tags that you are interested in - you will then only receive alerts related to those tags." It has published suggestions, advisories, solutions details related to website vulnerabilities.

(2.1) The security programming code flaw occurs at  “&TargetResource” parameter in “/startSSO.ping?” page.

 

References:

http://tetraph.com/security/open-redirect/cve-2014-8489-ping-identity-open_redirect
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01416.html

http://lists.openwall.net/full-disclosure/2014/12/09/5
https://vulnerabilitypost.wordpress.com/2014/04/29/cve-2014-8489-ping-identity
http://computerobsess.blogspot.com/2014/12/cve-2014-8489-ping-identity-corporation.html
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1302
packetstormsecurity.com/files/130841/Innovative-WebPAC-Pro-2.0-Open-Redirect.html
http://marc.info/?l=full-disclosure&m=141815926328949&w=4

http://seclists.org/fulldisclosure/2014/Dec/35

http://itsecurity.lofter.com/post/1cfbf9e7_54fc5a7

http://whitehatview.tumblr.com/post/106597418411/ithut-cve-2014-8489-

http://packetstormsecurity.com/files/129454/PingFederate-6.10.1-SP-Open-Redirect.html

https://itswift.wordpress.com/2014/12/30/cve-2014-8489-ping-identity-url_redirection

http://securityrelated.blogspot.com/2014/12/cve-2014-8489-ping-identity-corporation.html

http://www.osvdb.org/show/osvdb/115651

http://mathswift.blogspot.com/2014/12/cve-2014-8489-ping-identity-corporation.html

http://www.inzeed.com/kaleidoscope/computer-security/cve-2014-8489-ping-identity
http://diebiyi.com/articles/security/cve-2014-8489-ping-identity

Alvorlig feil i utbredt innloggingssystem

Alvorlig feil i utbredt innloggingssystem

Benyttes av Facebook, Google, Yahoo, LinkedIn, Microsoft og mange flere.

Wang Jing, en doktorgradstudent ved Nanyang Technological University i Singapore, har oppdaget en alvorlig sårbarhet knyttet til autentiseringssystemene OAuth 2.0 og OpenID. Sårbarheten, som er av typen «covert redirect», dreier seg om at en applikasjon tar en parameter og omdirigerer en bruker til parameteren uten tilstrekkelig validering. Ifølge Jing skyldes dette ofte at nettsteder har for stor tillit til sine partnere.

– Nettstedet sjekker domenenavnet mot et «token» (tildelt til partneren som et middel for verifisering) i den omdirigerte URL-en. Dersom paret er i godkjent-listen i nettstedets database, vil det tillate omdirigeringen. Men dersom URL-en tilhører et domene som har en «open redirect»-sårbarhet, kan brukerne omdirigeres fra nettstedet til et sårbart nettsted og deretter til en ondsinnet nettsted, skriver Jing.

http://www.digi.no/928515/alvorlig-feil-i-utbredt-innloggingssystem

Xuất hiện lỗ hổng Covert Redirect, bản sao của "Trái tim rỉ máu"

Xuất hiện lỗ hổng Covert Redirect, bản sao của "Trái tim rỉ máu"

Một nghiên cứu sinh tại trường Đại học Công nghệ Nanyang (Singapore) vừa phát hiện một lỗ hổng bảo mật tồn tại trong phần mềm mã nguồn mở đang được rất nhiều website sử dụng. Thông tin mới nhất cho thấy lỗ hổng này ảnh hưởng đến cả Google, Facebook, Microsoft, LinkedIn, PayPal và một số công ty lớn khác.

Wang Jing, nghiên cứu sinh tiến sĩ tại Đại học Công nghệ Nanyang là người phát hiện ra lỗ hổng đang tồn tại trong công cụ đăng nhập mã nguồn mở OAuth và OpenID. Wang Jing gọi lỗ hổng này là "Covert Redirect" (tạm dịch là Bí mật chuyển hướng). Hacker có thể gài mã độc ẩn dưới dạng một cửa sổ pop-up, hiện ra khi người dùng đăng nhập vào một website có lỗ hổng. Chẳng hạn như khi người dùng gõ địa chỉ Facebook, một cửa sổ pop-up hiện ra yêu cầu điền tên đăng nhập và mật khẩu. Nếu người dùng đưa thông tin vào thì những thông tin ấy sẽ "bí mật chuyển hướng" đến hacker.

http://ictnews.vn/cntt/bao-mat/xuat-hien-lo-hong-covert-redirect-ban-sao-cua-trai-tim-ri-mau-116528.ict

Covert Redirect Mengancam OAuth 2.0 dan OpenID

Covert Redirect Mengancam OAuth 2.0 dan OpenID

Pada Jumat lalu, Wang Jing, seorang mahasiswa program PhD di Nanyang Technological University di Singapura, menerbitkan sebuah laporan yang memjabarkan tentang metode serangan yang disebut dengan “Covert Redirect” dan memperkenalkannya sebagai kerentanan atau vulnerable di OAuth 2.0 dan OpenID.

Cara kerja OAuth 2.0 dan OpenID sendiri adalah dengan memberikan akses bagi pengguna layanan ini untuk mendapatkan domain yang dapat mengakses menggunakan kredensial yang telah ada kepada website lain seperti Facebook, Google, Microsoft atau LinkedIn. Dengan akses yang didapatkan pengguna layanan ini dapat menghapus sebuah akun dan menggantinya dengan akun yang baru.


http://www.inzeed.com/kaleidoscope/computer-security/covert-redirect-mengancam-oauth-2-0-dan-openid/

Continúan los problemas: OAuth y OpenID también son vulnerables

Un nuevo fallo de seguridad amenaza Internet. En este caso se trata de Covert Redirect y ha sido descubierto por un estudiante chino en Singapur. Las empresas tienen en sus manos solucionar este problema.



























Cuando aún resuenan los ecos de Heartbleed y el terremoto que sacudió la red, nos acabamos de enterar que otra brecha de seguridad compromete Internet. En este caso se trata de un fallo que afecta a páginas como Google, Facebook, Microsoft, Linkedin, Yahoo, PayPal, GitHub o Mail.ru que usan estas herramientas de código abierto para autenticar a sus usuarios.



Este error permitiría a un atacante haga creer a un usuario que una nueva ventana que redirija a Facebook es segura cuando en realidad no lo es. Hasta aquí la técnica se parece al phishing pero lo que hace lo hace diferente es que Covert Redirect, que así se llama el nuevo exploit, usa el dominio real pero hace un bypass del servidor para conseguir la info. Lo mejor que podemos hacer cuando estemos navegando y pulsemos en un sitio que abre un pop up que nos pide logearnos en Facebook o Google es cerrar esa ventana para evitar que nos redirija a sitios sospechosos.



Wang Jing, estudiante de doctorado en la Universidad Técnica de Nanyang (Singapur), es quien ha descubierto la vulnerabilidad y le ha puesto nombre. El problema, según Jing, es que ni el proveedor ni la compañía quieren responsabilizarse de esta brecha ya que costaría mucho tiempo y dinero. Seguramente, ahora que se conoce el caso, las compañías se pondrán manos a la obra.








Artículos Relacionados:

http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/

http://techxplore.com/news/2014-05-math-student-oauth-openid-vulnerability.html

http://phys.org/news/2014-05-math-student-oauth-openid-vulnerability.html

http://www.tomsguide.com/us/facebook-google-covert-redirect-flaw,news-18726.html

http://news.yahoo.com/facebook-google-users-threatened-security-192547549.html

http://thehackernews.com/2014/05/nasty-covert-redirect-vulnerability.html

http://www.scmagazine.com/covert-redirect-vulnerability-impacts-oauth-20-openid/article/345407/

http://computerobsess.blogspot.com/2014/10/id-oauth.html

http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html

http://russiapost.blogspot.ru/2014/11/openid-oauth-20.html?view=sidebar

https://hackertopic.wordpress.com/2014/07/11/oauth-openid-covert-redirect

http://germancast.blogspot.de/2014/11/sicherheitslucke-in-oauth-20-und-openid.html

http://diebiyi.com/articles/security/covert-redirect/sicherheitslucke-in-oauth-2-0-und-openid-gefunden/

http://www.inzeed.com/kaleidoscope/covert-redirect/openid-oauth-2.0

https://webtechwire.wordpress.com/2014/12/09/oauth%E3%81%A8openid%E3%81

http://tetraph.tumblr.com/post/118850487757/itinfotech-covert
http://webtechhut.blogspot.com/2014/12/continuan-los-problemas-oauth-y-openid.html

http://frenchairing.blogspot.fr/2014/11/des-vulnerabilites-pour-les-boutons.html

https://itswift.wordpress.com/2014/06/06/covert-redirect-openid-oauth

http://blog.kaspersky.com/facebook-openid-oauth-vulnerable/

http://whitehatpost.lofter.com/post/1cc773c8_6f0b389

http://itprompt.blogspot.com/2014/12/falha-de-seguranca-afeta-logins-de.html

http://www.foxnews.com/tech/2014/05/05/facebook-google-users-threatened-by-new-security-flaw/

http://www.tetraph.com/blog/covert-redirect/sicherheitslucke-in-oauth-2-0-und-openid-gefunden/

http://www.inzeed.com/kaleidoscope/covert-redirect/372/

Falha de segurança afeta logins de Facebook, Google e Microsoft

Um estudante de PHD de Singapura, Wang Jing, identificou a falha, chamada de “Covert Redirect”, que consegue usar domínios reais de sites para verificação de páginas de login falsas, enganando os internautas.



Os cibercriminosos podem criar links maliciosos para abrir janelas pop-up do Facebook pedindo que o tal aplicativo seja autorizado. Caso seja realizada esta sincronização, os dados pessoais dos usuários serão passados para os hackers.



Wang afirma que já entrou em contato com o Facebook, porém recebeu uma resposta de que “entende os riscos de estar associado ao OAuth 2.0″ e que corrigir a falha “é algo que não pode ser feito por enquanto”.



O Google afirmou que o problema está sendo rastreado, o LinkedIn publicou nota em que garante que já tomou medidas para evitar que a falha seja explorada, e a Microsoft negou que houvesse vulnerabilidade em suas páginas, apenas nas de terceiros.



A recomendação do descobridor da falha para os internautas é que evitem fazer o login com dados de confirmação de Facebook, Google ou qualquer outro serviço sem terem total certeza de que estão em um ambiente seguro.





Especialistas: erro é difícil de corrigir

O site CNET ouviu dois especialistas em segurança virtual sobre o assunto. Segundo Jeremiah Grossman, fundador e CEO interino da WhiteHat Security, afirma que a falha “não é fácil de corrigir”. Segundo Chris Wysopal, diretor da Veracode, a falha pode enganar muita gente.


“A confiança que os usuários dão ao Facebook e outros serviços que usam OAuth pode tornar mais fácil para os hackers enganarem as pessoas para que elas acabem dando suas informações pessoais a ele”, afirma Wsyopal.

notícias relacionadas:

http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/

http://techxplore.com/news/2014-05-math-student-oauth-openid-vulnerability.html

http://phys.org/news/2014-05-math-student-oauth-openid-vulnerability.html

http://www.tomsguide.com/us/facebook-google-covert-redirect-flaw,news-18726.html

http://news.yahoo.com/facebook-google-users-threatened-security-192547549.html

http://thehackernews.com/2014/05/nasty-covert-redirect-vulnerability.html

http://www.scmagazine.com/covert-redirect-vulnerability-impacts-oauth-20-openid/article/345407/

http://computerobsess.blogspot.com/2014/10/id-oauth.html

http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html

http://russiapost.blogspot.ru/2014/11/openid-oauth-20.html?view=sidebar

https://hackertopic.wordpress.com/2014/07/11/oauth-openid-covert-redirect

http://germancast.blogspot.de/2014/11/sicherheitslucke-in-oauth-20-und-openid.html

http://diebiyi.com/articles/security/covert-redirect/sicherheitslucke-in-oauth-2-0-und-openid-gefunden/

http://www.inzeed.com/kaleidoscope/covert-redirect/openid-oauth-2.0

https://webtechwire.wordpress.com/2014/12/09/oauth%E3%81%A8openid%E3%81

http://tetraph.tumblr.com/post/118850487757/itinfotech-covert

http://frenchairing.blogspot.fr/2014/11/des-vulnerabilites-pour-les-boutons.html

https://itswift.wordpress.com/2014/06/06/covert-redirect-openid-oauth

http://blog.kaspersky.com/facebook-openid-oauth-vulnerable/

http://whitehatpost.lofter.com/post/1cc773c8_6f0b389

http://www.foxnews.com/tech/2014/05/05/facebook-google-users-threatened-by-new-security-flaw/

http://www.tetraph.com/blog/covert-redirect/sicherheitslucke-in-oauth-2-0-und-openid-gefunden/

http://www.inzeed.com/kaleidoscope/covert-redirect/372/

하트블리드 이어 ‘오픈ID’와 ‘오쓰(OAuth)’서도 심각한 보안 결함

‘하트블리드(Heartbleed)’ 버그에 이어 가입자 인증 및 보안용 오픈소스 SW인 ‘오픈ID’와‘오쓰(OAuth)’에도 심각한 결함이 발견됐다고 씨넷, 벤처비트 등 매체들이 보도했다.

싱 가폴난양대학교에 재학중인 ‘왕 징(Wang Jing)’ 박사는 수 많은 웹사이트와 구글, 페이스북, 링크드인, MS, 페이팔 등에서 사용하고 있는 로그인 툴인 ‘OAuth’와‘오픈ID’에 치명적인 결함이 발견됐다고 밝혔다. ‘코버트리디렉트(Covert Redirect)’라고 일컬어지는 이 결함은 감염된 도메인의 로그인 팝업을 통해 해킹이 이뤄진다.

가 령 인터넷 사용자들이 악의적인 피싱 사이트를 클릭하면 가입자 인증을 위해 페이스북 팝업 윈도가 뜨는데 가입자를 속이 기위해 가짜 도메인 이름을 사용하는 것이 아니라 진짜 사이트의 도메인을 활용한다고 한다. 만일 가입자가 로그인을 하면 합법적인 사이트가 아니라 피싱사이트로 e메일 주소, 생일, 연락처 등 개인 정보들이 흘러들어간다.

왕 은 페이스북 등 업체에 이 같은 결함을 알렸으며 페이스북은 결함이 OAuth 2.0가 연관된 것으로 인식하고 있지만 짧은 시간내 해결될 수는 없을 것이란 답을 얻은 것으로 알려졌다. 왕은 이번 결함이 구글, 링크드인, 마이크로소프트, 페이스북, 페이팔 등 다수의 오픈ID와 OAuth를 활용하는 기업들이 영향을 받을 것으로 예상했다.

왕 은 “제3의 애플리케이션 개발자들이 화이트리스트를 엄격하게 적용하면 해커 공격의 빌미를 제공하지 않을 것”이라고 말했다. 하지만 “실제로 많은 애플리케이션 개발자들이 여러가지 이유로 이런 조치를 취하지않고 있다는 게 OAuth 2.0과 오픈ID의 결함 문제를 심각하게 만들고 있다”고 덧붙였다.

관련 뉴스：

http://www.it.co.kr/news/article.html?no=2628799&sec_no=181

http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/

http://techxplore.com/news/2014-05-math-student-oauth-openid-vulnerability.html

http://phys.org/news/2014-05-math-student-oauth-openid-vulnerability.html

http://www.tomsguide.com/us/facebook-google-covert-redirect-flaw,news-18726.html

http://news.yahoo.com/facebook-google-users-threatened-security-192547549.html

http://thehackernews.com/2014/05/nasty-covert-redirect-vulnerability.html

http://www.scmagazine.com/covert-redirect-vulnerability-impacts-oauth-20-openid/article/345407/

http://tech.ifeng.com/internet/detail_2014_05/03/36130721_0.shtml/

http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html

http://russiapost.blogspot.ru/2014/11/openid-oauth-20.html?view=sidebar

https://hackertopic.wordpress.com/2014/12/12/%ED%95%98%ED%8

http://germancast.blogspot.de/2014/11/sicherheitslucke-in-oauth-20-und-openid.html

http://diebiyi.com/articles/security/covert-redirect/sicherheitslucke-in-oauth-2-0-und-openid-gefunden/

http://www.inzeed.com/kaleidoscope/covert-redirect/openid-oauth-2.0

https://webtechwire.wordpress.com/2014/12/09/oauth%E3%81%A8

http://tetraph.tumblr.com/post/118850487757/itinfotech-covert

http://frenchairing.blogspot.fr/2014/11/des-vulnerabilites-pour-les-boutons.html

https://itswift.wordpress.com/2014/12/06/%D1%81%D0%B8

http://blog.kaspersky.com/facebook-openid-oauth-vulnerable/

http://whitehatpost.lofter.com/post/1cc773c8_6f0b389

http://www.foxnews.com/tech/2014/05/05/facebook-google-users-threatened-by-new-security-flaw/

http://www.tetraph.com/blog/covert-redirect/sicherheitslucke-in-oauth-2-0-und-openid-gefunden/

http://www.inzeed.com/kaleidoscope/covert-redirect/372/

eBay Covert Redirect Web Security Bugs Based on Googleads.g.doubleclick.net

eBay Covert Redirect Vulnerability Based on Googleads.g.doubleclick.net

(1) WebSite:

ebay.com

"eBay Inc. (stylized as ebay, formerly eBay) is an American multinational corporation and e-commerce company, providing consumer to consumer & business to consumer sales services via Internet. It is headquartered in San Jose, California. eBay was founded by Pierre Omidyar in 1995, and became a notable success story of the dot-com bubble. Today, it is a multi-billion dollar business with operations localized in over thirty countries.

The company manages eBay.com, an online auction and shopping website in which people and businesses buy and sell a broad variety of goods and services worldwide. In addition to its auction-style sales, the website has since expanded to include "Buy It Now" shopping; shopping by UPC, ISBN, or other kind of SKU (via Half.com); online classified advertisements (via Kijiji or eBay Classifieds); online event ticket trading (via StubHub); online money transfers (via PayPal) and other services." (Wikipedia)

(2) Vulnerability Description:

eBay web application has a computer cyber security problem. Hacker can exploit it by Covert Redirect attacks. 

The vulnerability occurs at “ebay.com/rover” page with “&mpre” parameter, i.e.
http://rover.ebay.com/rover/1/711-67261-24966-0/2?mtid=691&kwid=1&crlp=1_263602&itemid=370825182102&mpre=http://www.google.com
The vulnerability can be attacked without user login. Tests were performed on Firefox (26.0) in Ubuntu (12.04) and IE (9.0.15) in Windows 7.

(2.1) When a user is redirected from eBay to another site, eBay will check whether the redirected URL belongs to domains in eBay’s whitelist, e.g.

google.com

If this is true, the redirection will be allowed.

However, if the URLs in a redirected domain have open URL redirection vulnerabilities themselves, a user could be redirected from eBay to a vulnerable URL in that domain first and later be redirected from this vulnerable site to a malicious site. This is as if being redirected from eBay directly.

One of the vulnerable domain is,

http://googleads.g.doubleclick.net (Google’s Ad system)

(2.2) Use one of  webpages for the following tests. The webpage address is “http://itinfotech.tumblr.com/“. We can suppose that this webpage is malicious.

Vulnerable URL:

http://rover.ebay.com/rover/1/711-67261-24966-0/2?mtid=691&kwid=1&crlp=1_263602&itemid=370825182102&mpre=http://www.google.com

POC:

http://rover.ebay.com/rover/1/711-67261-24966-0/2?mtid=691&kwid=1&crlp=1_263602&itemid=370825182102&mpre=http://googleads.g.doubleclick.net/aclk?sa=L%26ai=C-RHnNvn2Uom8LeTaigfjkIHICfLQnccEAAAQASAAUNTx5Pf4_____wFgvwWCARdjYS1wdWItMDQ2NjU4MjEwOTU2NjUzMsgBBOACAKgDAaoEhQFP0LHofgVzg8U9Bvwu2_hN9Ow0n2tBH9xjKtngqcF6hgGQpxV6QzMgNxx0_UawPG3-UD097GLLCirbVMl2QxQqa04U3cp4YFgV5dshYbzmqlVVfNn-NuunzLNab6ATE5BUwQ9bgXBOW_qEz8qgbwVOvUJrn1IzL-ymANaKsQLZ9POlkbIe4AQBoAYV%26num=0%26sig=AOD64_3a3m_P_9GRVFc6UIGvnornMcLMoQ%26client=ca-pub-0466582109566532%26adurl=http://itinfotech.tumblr.com/

Poc Video:
https://www.youtube.com/watch?v=a4H-u17Y9ks

Blog Detail:

http://securityrelated.blogspot.com/2014/11/ebay-covert-redirect-vulnerability.html

(3) What is Covert Redirect? 

Covert Redirect is a class of security bugs disclosed in May 2014. It is an application that takes a parameter and redirects a user to the parameter value without sufficient validation. This often makes use of Open Redirect and XSS vulnerabilities in third-party applications.

Covert Redirect is also related to single sign-on. It is known by its influence on OAuth and OpenID. Hacker may use it to steal users' sensitive information. Almost all OAuth 2.0 and OpenID providers worldwide are affected. Covert Redirect was found and dubbed by a Mathematics PhD student Wang Jing from School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore.


After Covert Redirect was published, it is kept in some common databases such as SCIP, OSVDB, Bugtraq, and X-Force. Its scipID is 13185, while OSVDB reference number is 106567. Bugtraq ID: 67196.  X-Force reference number is 93031.

Discover and Reporter:

Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

http://tetraph.com/wangjing/

Related Articles:
http://tetraph.com/security/covert-redirect/ebay-covert-redirect-vulnerability
http://computerobsess.blogspot.com/2014/11/ebay-covert-redirect-vulnerability.html
https://webtechwire.wordpress.com/2014/06/05/ebay-bug/

https://twitter.com/tetraphibious/status/559167810543181825

http://aga.ustc.edu.cn/news/view?id=2094
http://tetraph.blog.163.com/blog/static/234603051201443922472/
http://ittechnology.lofter.com/post/1cfbf60d_7063707

http://www.ustcif.com/default.php/content/2128/
http://itinfotech.tumblr.com/post/118850342491/covert-redirect

http://tetraph.blogspot.com/2014/11/ebay-covert-redirect-vulnerability.html

http://www.inzeed.com/kaleidoscope/covert-redirect/ebay-covert-redirect

https://itswift.wordpress.com/2014/06/02/ebay-bug/