The origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.
The getAllowedOrigin() function checks if the Referer header starts with any allowed origin:
// https://github.com/feathersjs/feathers/blob/dove/packages/authentication-oauth/src/strategy.ts#L75
const allowedOrigin = origins.find((current) => referer.toLowerCase().startsWith(current.toLowerCase()));
This comparison is insufficient as it only validates the prefix. This is exploitable when the origins array is configured and an attacker registers a domain starting with an allowed origin string (e.g., https://target.com.attacker.com bypasses https://target.com).
On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover.
Credits: Abdelwahed Madani Yousfi (@vvxhid) / Edoardo Geraci (@b0-n0-b0) / Thomas Rinsma (@ThomasRinsma) From Codean Labs.
The origin validation uses
startsWith()for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.The
getAllowedOrigin()function checks if the Referer header starts with any allowed origin:This comparison is insufficient as it only validates the prefix. This is exploitable when the
originsarray is configured and an attacker registers a domain starting with an allowed origin string (e.g.,https://target.com.attacker.combypasseshttps://target.com).On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover.
Credits: Abdelwahed Madani Yousfi (@vvxhid) / Edoardo Geraci (@b0-n0-b0) / Thomas Rinsma (@ThomasRinsma) From Codean Labs.