Into the symmetry

Yesterday while reading my Twitter stream I found this interesting article about  downloading GitHub SSO bypass codes . Same as Yasin Soliman I was invited to a Github pre-release of the organisation SAML single sign-on (SSO) private program. And same as him I found an issue in the same endpoint. So I thought to write a quick blog post about it. Github already published a tl;dr about this,  I will try to fill the blanks here. As mentioned by Yasin, Github offers an endpoint where privileged users can recover bypass codes. These recovery codes were accessible for download as plaintext and had the content-type as text/plain , something like: What immediately caught my attention was that the format of the code forms (with some exceptions) a valid JavaScript file with lines in the format of XXXXX-XXXXX , ten hex digits separated by a hyphen. This is interpreted in JavaScript as the subtraction of two variables! This remember an old blog post of mine ...

We all know about this massive Google Doc Phishing Attack that hit about 1 million accounts right? Image from https://arstechnica.com/security/2017/05/dont-trust-oauth-why-the-google-docs-worm-was-so-convincing/ Well this really "sophisticated attack" (really??) was based on a really spread Internet procol named OAuth . It also turns out that during the early stage of the standardization someone reported this very own attack vector but as often happens he was ignored.  Back in 2015 I also reported another "hidden feature"  of OAuth that turns an OAuth server into an open redirector that makes phishing a piece of cake. Yesterday I was twitting about this and today I decided to imitate Eugene Pupov (lol) and work on my master thesis project. So this is the resulting mail. Have fun: Fret not, go ahead and click and you will be redirected to:   that is not a Github page but is rather controlled by me. Well that's all folks...