Connect with us
X
Categories:

Technology

Dex fixes authentication flaw that made client applications accessible to unauthorized users

Published

on

Dex fixes authentication flaw that made client applications accessible to unauthorized users
Share this post:

OpenID Connect (OIDC) identity service Dex has patched a critical vulnerability that would allow an attacker to fetch an ID token through an intercepted authorization code and potentially gain unauthorized access to client applications.

Dex uses OIDC , a simple identity layer on top of the OAuth 2.0 protocol, to power authentication for other apps. It acts as a portal to other identity providers through ‘connectors’, allowing it to defer authentication to LDAP servers, SAML providers, or identity providers such as GitHub, Google, and Active Directory.

Dex, an open source sandbox project from the Cloud Native Computing Foundation, has been downloaded 35.6 million times.

Consent problem

Security researchers discovered that an attacker who can dupe a victim into navigating to a malicious website can steal the OAuth authorization code, exchange it for a token, and then gain access to applications that accept that token. The exploit can be used multiple times, allowing the attacker to get a new token every time the old one expires.

“The cause of the bug is the implementation of the consent page,” Dex maintainer Maksim Nabokikh tells Daily Swig.

“This page is supposed to protect users from sharing too much profile data with the application. Instead, it created a hole in Dex. If fraudsters can access this page before a user, they can steal not only all the user’s data but also impersonate it.”

Reproduction steps

When the victim navigates to the malicious website, Dex returns a 302 Redirect to the connector IDP, according to a GitHub security advisory. The exploit then involves recording the state parameter value g3dkmpontsr3ugocoddjx72ef, which later becomes the request ID.

The website subsequently redirects the victim’s browser to the connector IDP, to which the user authenticates. And if the user has authenticated before, authentication may be carried out without a challenge, with the connector IDP redirecting the browser to the Dex callback with a code.

RECOMMENDED  Nigeria’s Internet speed ranks low amid rising 3G, 4G subscriptions

Dex then fetches the user claims from the connector IDP, persisting them and generating an OAuth code, before redirecting the browser to the approval endpoint. The reproduction steps conclude with Dex using the request ID to look up the OAuth code, and building a redirect to the original callback .

The flaw, which has a CVSS rating of 9.3, affects versions 2.34.0 and earlier, with users advised to update to version 2.35.0. Those using Google connector should upgrade to 2.35.1 instead.

The patch was created by Sigstore developers Hayden Blauzvern, Bob Callaway, and ‘joernchen’, the original reporter of the bug.

The fix involved introducing a hash-based message authentication (HMAC) code, which uses a randomly generated per-request secret that can’t be known to an attacker and is persisted between the initial login request and the approval request.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment
Realme GT Neo 7 will pack current top-performing SoC in AnTuTu's ranking — Tipster
Technology10 hours ago

Realme GT Neo 7 will pack current top-performing SoC in AnTuTu’s ranking — Tipster

Samsung Galaxy S24 FE receives October 2024 security patch following recent critical Galaxy bug
Technology10 hours ago

Samsung Galaxy S24 FE receives October 2024 security patch following recent critical Galaxy bug

The key to Kai Havertz's success at Arsenal — Mikel Arteta
Sports11 hours ago

The key to Kai Havertz’s success at Arsenal — Mikel Arteta

Martin Odegaard gives injury update ahead of Arsenal vs Southampton
Sports11 hours ago

Martin Odegaard gives injury update ahead of Arsenal vs Southampton

The government orders evacuation as Ondo suffers greatly by flooding
News11 hours ago

The government orders evacuation as Ondo suffers greatly by flooding

Ogun State commissioner salutes teachers’ resilience and courage
News11 hours ago

Ogun State commissioner salutes teachers’ resilience and courage

Police arrest suspected serial killer in Ogun State
News12 hours ago

Police arrest suspected serial killer in Ogun State

Success not only defined by winning awards — Adediwura Blarkgold
Entertainment12 hours ago

Success not only defined by winning awards — Adediwura Blarkgold

I’m not interested in BBL — Ebun Hodo
Entertainment12 hours ago

I’m not interested in BBL — Ebun Hodo

Memories of how "Alaga Ibile" transformed his life and sold 13 million copies — Reminisce
Entertainment14 hours ago

Memories of how “Alaga Ibile” transformed his life and sold 13 million copies — Reminisce

Chris Brown sells out Africa's largest stadium in just 2 hours
Entertainment14 hours ago

Chris Brown sells out Africa’s largest stadium in just 2 hours

Apple's upcoming affordable iPhone would allegedly mix features from past three flagships
Technology1 day ago

Apple’s upcoming affordable iPhone would allegedly mix features from past three flagships

Robot vacuum from prominent brand has cameras and speakers hacked, according to report
Technology1 day ago

Robot vacuum from prominent brand has cameras and speakers hacked, according to report

Arsenal reacts to the Brazilian team's "in recent days" bid for Gabriel Jesus
Sports1 day ago

Arsenal reacts to the Brazilian team’s “in recent days” bid for Gabriel Jesus

Tyson Fury compared to Vladimir Putin following foul-mouthed outburst before of Oleksandr Usyk's rematch
Sports1 day ago

Tyson Fury compared to Vladimir Putin following foul-mouthed outburst before of Oleksandr Usyk’s rematch

Rapper Phyno denies the Olamide similarity, claims they are brothers
Entertainment1 day ago

Rapper Phyno denies the Olamide similarity, claims they are brothers

‘Thousands’ of fake Oasis tickets appear before North America tour sale starts
Entertainment1 day ago

‘Thousands’ of fake Oasis tickets appear before North America tour sale starts

Why Billie Eilish fans meowing at her concert?
Entertainment1 day ago

Why Billie Eilish fans meowing at her concert?

Pastor Enoch Adeboye apologizes for tithing remarks
News1 day ago

Pastor Enoch Adeboye apologizes for tithing remarks

Tinubu’s aide: CFR honours not to undermine Reps
News1 day ago

Tinubu’s aide: CFR honours not to undermine Reps

Ogun State commissioner salutes teachers’ resilience and courage
News1 day ago

Ogun State threatens to shut private schools not complying with education policy

Oura Ring 4 promises 'most accurate' health monitoring
Technology2 days ago

Oura Ring 4 promises ‘most accurate’ health monitoring

A significant change to video calls is imminent — WhatsApp
Technology2 days ago

A significant change to video calls is imminent — WhatsApp

Ray Parlour responds to Frank Lampard’s claim about William Saliba and Gabriel Magalhaes
Sports2 days ago

Ray Parlour responds to Frank Lampard’s claim about William Saliba and Gabriel Magalhaes

Sean Dyche makes Jarrad Branthwaite claim amid Manchester United and Liverpool interest
Sports2 days ago

Sean Dyche makes Jarrad Branthwaite claim amid Manchester United and Liverpool interest

ICPC recovered N13bn looted funds in Sept – Musa Aliyu
News3 days ago

ICPC recovered N13bn looted funds in Sept – Musa Aliyu

FG stops VAT on diesel, cooking gas
News3 days ago

FG stops VAT on diesel, cooking gas

Naira notes Emefiele released was not what Buhari approved — Witness
News3 days ago

Naira notes Emefiele released was not what Buhari approved — Witness

Wizkid previews two new songs as he gears up for the release of 'Morayo'
Entertainment3 days ago

Wizkid previews two new songs as he gears up for the release of ‘Morayo’

Jade Osiberu is under fire for her 2022 post about Peter Obi
Entertainment3 days ago

Jade Osiberu is under fire for her 2022 post about Peter Obi

Karen Igho opens up about marital struggles, “I'm homeless”
Entertainment3 days ago

Karen Igho opens up about marital struggles, “I’m homeless”

Microsoft Office 2024 is available now without a subscription, with new features and design
Technology3 days ago

Microsoft Office 2024 is available now without a subscription, with new features and design

Redmi Note 14 Pro+ is ranked as the latest mid-range phone in the AnTuTu top 10
Technology3 days ago

Redmi Note 14 Pro+ is ranked as the latest mid-range phone in the AnTuTu top 10

If we go on strike, put the blame on FG — ASUU
News3 days ago

If we go on strike, put the blame on FG — ASUU

Edo Assembly recalls two members after five months suspension
News3 days ago

Edo Assembly recalls two members after five months suspension

Tinubu departs for the UK for a two-week annual leave
News3 days ago

Tinubu departs for the UK for a two-week annual leave

Manchester United players want Ruud van Nistelrooy to take charge if Erik ten Hag gets sacked
Sports3 days ago

Manchester United players want Ruud van Nistelrooy to take charge if Erik ten Hag gets sacked

Mikel Merino describes the strange injury that kept him from making his Arsenal debut
Sports3 days ago

Mikel Merino describes the strange injury that kept him from making his Arsenal debut

Wizkid takes another swipe at Davido in fiery exchange, ‘No talent’
Entertainment3 days ago

Wizkid takes another swipe at Davido in fiery exchange, ‘No talent’

3-time Oscar winner Sir Daniel Day-Lewis unretires from acting to appear in debut film from son
Entertainment4 days ago

3-time Oscar winner Sir Daniel Day-Lewis unretires from acting to appear in debut film from son

Kylian Mbappe celebrates after scoring a goal for PSG against Juventus in the Champions League
ANE Football Analytical7 days ago

What About PSG, Ligue 1 after Mbappe’s Transfer to Real Madrid

China open to more loans, investments in Nigeria — FG
News6 days ago

China open to more loans, investments in Nigeria — FG

Mbappe and Kylian Mbappe
ANE Football Analytical7 days ago

France Brothers: Dembele Tricked into Joining PSG, Deserted by Mbappe

Warning against female genital mutilation — Kwara agency
News7 days ago

Warning against female genital mutilation — Kwara agency

Why Anthony Joshua was "suspended" after losing to Daniel Dubois by knockout
Sports6 days ago

Why Anthony Joshua was “suspended” after losing to Daniel Dubois by knockout

Cole Palmer hailed as the ‘best player in the Premier League’
Sports7 days ago

Cole Palmer hailed as the ‘best player in the Premier League’

Phyno featuring British rap artist Arrdee on his latest single, "Time of my Life"
Entertainment6 days ago

Phyno featuring British rap artist Arrdee on his latest single, “Time of my Life”

Pedri blames referee for Barcelona’s first league defeat
Sports7 days ago

Pedri blames referee for Barcelona’s first league defeat

Netflix has recently introduced a forgotten BBC masterpiece
Entertainment6 days ago

Netflix has recently introduced a forgotten BBC masterpiece

Kobbie Mainoo and Alejandro Garnacho have ‘Manchester United DNA’ — Patrice Evra
Sports4 days ago

Kobbie Mainoo and Alejandro Garnacho have ‘Manchester United DNA’ — Patrice Evra

If we go on strike, put the blame on FG — ASUU
News6 days ago

FG raises teams in order to avert the ASUU strike

Shaibu disputes a plan to storm the Edo government house
News6 days ago

Shaibu disputes a plan to storm the Edo government house

Manchester United make decision on Erik ten Hag future after Tottenham humiliation
Sports7 days ago

Manchester United youngsters to step up amid transfer ‘restrictions’ — Erik ten Hag

Actors you totally forgot appeared in James Bond films
Entertainment7 days ago

Actors you totally forgot appeared in James Bond films

Bobrisky: Reps question NCoS and EFCC officials over alleged bribery
Entertainment4 days ago

Bobrisky: Reps question NCoS and EFCC officials over alleged bribery

#October1protest: Sowore joins protesters in Lagos
News4 days ago

#October1protest: Sowore joins protesters in Lagos

X Factor stars G4 continue their 20th-anniversary tour after devastating death of bandmate
Entertainment6 days ago

X Factor stars G4 continue their 20th-anniversary tour after devastating death of bandmate

Country music legend Kris Kristofferson dies aged 88
Entertainment6 days ago

Country music legend Kris Kristofferson dies aged 88

Nigeria@64: We must reform or collapse — President Tinubu
News4 days ago

Nigeria@64: We must reform or collapse — President Tinubu

Edo community protests Obaseki’s choice of traditional ruler
News7 days ago

Edo community protests Obaseki’s choice of traditional ruler

#FearlessOctober1 protest: It will hold at Eagle Square — Organisers tell police
News7 days ago

#FearlessOctober1 protest: It will hold at Eagle Square — Organisers tell police

Chris Martin reveals the precise day Coldplay will officially retire
Entertainment6 days ago

Chris Martin reveals the precise day Coldplay will officially retire

Legion Y700: Lenovo launches new gaming tablet with a competitive starting price
Technology6 days ago

Legion Y700: Lenovo launches new gaming tablet with a competitive starting price

Puff Diddy taken off suicide watch in jail, receives visit from family
Entertainment5 days ago

Puff Diddy taken off suicide watch in jail, receives visit from family

Manchester United make decision on Erik ten Hag future after Tottenham humiliation
Sports5 days ago

Manchester United make decision on Erik ten Hag future after Tottenham humiliation

Nigeria@64: Revisiting prominent political-musical intersections
Entertainment4 days ago

Nigeria@64: Revisiting prominent political-musical intersections

Declan Rice addresses allegations that Arsenal is “cheating” in Premier League matches
Sports6 days ago

Declan Rice addresses allegations that Arsenal is “cheating” in Premier League matches

Lenovo Chromebook Duet 11 launches with a refreshed design,
Technology4 days ago

Lenovo Chromebook Duet 11 launches with a refreshed design

Expert advises companies to use AI for more intelligent operations
Technology5 days ago

Expert advises companies to use AI for more intelligent operations

IBM, UNDP unveil AI solutions for clean energy promotion
Technology5 days ago

IBM, UNDP unveil AI solutions for clean energy promotion

Phyno shares details about next album
Entertainment4 days ago

Phyno shares details about next album

Edo Assembly recalls two members after five months suspension
News3 days ago

Edo Assembly recalls two members after five months suspension

Giant 'Energy Dome' carbon-dioxide bubble in the US could power 18,000 homes for 10 hours
Technology6 days ago

Giant ‘Energy Dome’ carbon-dioxide bubble in the US could power 18,000 homes for 10 hours

Why you can’t watch Adele and Nirvana videos on YouTube
Entertainment4 days ago

Why you can’t watch Adele and Nirvana videos on YouTube

Naira notes Emefiele released was not what Buhari approved — Witness
News3 days ago

Naira notes Emefiele released was not what Buhari approved — Witness

Nigeria@64: Adamawa youths celebrate Tinubu, shun protest
News4 days ago

Nigeria@64: Adamawa youths celebrate Tinubu, shun protest

Nigeria@64: Tinubu, Shettima, lead celebrations at 64th Independence Day parade
News4 days ago

Nigeria@64: Tinubu, Shettima, lead celebrations at 64th Independence Day parade

Arne Slot provides an injury update on Diogo Jota and Federico Chiesa before Liverpool vs Bologna
Sports4 days ago

Arne Slot provides an injury update on Diogo Jota and Federico Chiesa before Liverpool vs Bologna

If we go on strike, put the blame on FG — ASUU
News3 days ago

If we go on strike, put the blame on FG — ASUU

If I say anything, let me die — VDM to reps Panel
Entertainment5 days ago

If I say anything, let me die — VDM to reps Panel

ANE Billboard Hots