API security vulnerabilities found in social sign-in mechanisms of Grammarly, Vidio and Bukalapak sites have been remediated but are likely to impact other sites
PALO ALTO, Calif. – October 24, 2023 – Salt Security, the leading API security company, today released new threat research from Salt Labs highlighting API security vulnerabilities uncovered in the social sign-in and Open Authentication (OAuth) implementations of multiple online companies, including Grammarly, Vidio, and Bukalapak. The flaws, which have since been remediated, could have allowed for credentials leakage and enabled full account takeover (ATO). Salt Labs also reported that 1000s of other websites using social sign-in mechanisms are likely vulnerable to the same type of attack, putting billions of individuals around the globe at risk.
These findings mark the third and final research report in the Salt Labs OAuth hijacking series, following vulnerabilities uncovered in Booking.com and Expo earlier this year.
This latest research identified flaws in the access token verification step of the social sign-in process, part of the OAuth implementation on each of these different websites. Cumulatively, on these three sites, the vulnerabilities could have impacted near a billion user accounts. Moreover, the Salt Labs team expects that 1000s of other websites are also susceptible to these flaws, putting billions of additional Internet users at risk.
The vulnerabilities identified could allow cyber criminals to:
Favored across many websites and web services, OAuth enables a "one click" login that lets users tap their social media accounts, such as Google or Facebook, to verify their identity and register on a site rather than set up a unique username/password combination for access. For this type of login, OAuth needs a verified token to approve access, and all three sites failed to verify the token. As a result, the Salt Labs researchers were able to insert a token from another site as a verified token and gain access to user accounts - using a technique called “Pass-The-Token Attack”
Vidio, an online video streaming platform with 100M monthly active users, offers a range of content, including movies, TV shows, live sports, and original productions.
Salt Labs’ researchers discovered OAuth security vulnerabilities when logging in through Facebook. Because the Vidio.com site did not verify the token, which OAuth details must be done by the website developers and not OAuth itself, an attacker could manipulate the API calls to insert an access token generated for a different application. This alternate token/AppID combination gave the Salt Labs research team the ability to impersonate a user on the Vidio site, which would have allowed massive account takeover on thousands of accounts.
Bukalapak is one of the largest and most prominent eCommerce platforms in Indonesia, with more than 150 million users every month.
Similar to Vidio, Bukalapak didn’t verify the access token when users registered using a social-login. Therefore, by inserting a token from another website, the Salt Labs team could access the credentials of a user in bukalapak.com and completely take over that user’s account.
Grammarly.com is an AI-powered writing tool that helps users improve their writing by offering grammar, punctuation, spelling checks, and other writing tips to more than 30 million users every day.
By doing reconnaissance on the API calls and learning the terminology the Grammarly site uses to send the code, the Salt Labs team was able to manipulate the API exchange to insert code used to verify users on a different site and, again, obtain the credentials of a user’s account and achieve full account takeover.
Upon discovering the vulnerabilities on all three sites, Salt Labs’ researchers followed coordinated disclosure practices, and all issues have been remediated.
“OAuth is one of fastest adopted technologies in the AppSec domain and has quickly become one of the most popular protocols for both user authorization and authentication,” said Yaniv Balmas, VP of Research, Salt Security. “The Salt Labs research illustrates the potential impacts that OAuth implementation issues can have on a business and its customers. We hope this series has helped educate the broader industry on the nature of potential OAuth implementation errors and how to close these API-based security gaps to better protect data and use OAuth more securely.”
The Salt Security State of API Security Report, Q1 2023 showed a 400% increase in unique attackers in the last six months, with 43% of respondents stating account takeover (ATO) as a high concern. The Salt Security API Protection Platform is the only API security solution that combines the power of cloud-scale big data and time-tested ML/AI to detect and prevent API attacks. By correlating activities across millions of APIs and users over time, Salt delivers deep context with real-time analysis and continuous insights into API threats and vulnerabilities, including those outlined in the OWASP API Security Top 10 list.
The full report, including how Salt Labs conducted this research and steps for mitigation, is available here. To learn more about Salt Security, its platform, or to request a demo, please visit https://content.salt.security/demo.html.
If you will be onsite at SecTor Aviad Carmel and Yaniv Balmas will be hosting a speaking session titled: "Uh-OAuth! - Breaking (and Fixing) OAuth Implementations" - Wednesday, October 25, 4:00-5:00pm, Meeting Room 718A.