Originally submitted by Edmund Jay (Edmund Jay) on 2017-03-17
This is an attack listed in the report SoK: Single Sign-On Security – An Evaluation of OpenID Connect.
In this test, the Attacker OP returns maliciously crafted Discovery document and afterward to create an ID Token containing the identity of the victim, which is controlled by another OP – Honest OP.
Prerequisite
- The client does not have per authorization server redirection URI.
Execution
The Attacker OP returns the following configuration during the Discovery phase.
#!javascript
{
"issuer": "https://opivAttackerOP.com",
"registration_endpoint": "https://opivHonestOP.com/register",
"authorization_endpoint": "https://opivHonestOP.com/auth",
"token_endpoint": "https://opivAttackerOP.com/token",
"userinfo_endpoint": "https://opivAttackerOP.com/userinfo"
...
}
Result Evaluation
The goal of this test is to verify whether the End-User authentication can be broken. The attack is successful if the Attacker OP receives any secret information, for example, client_id, client_secret, code or access token, generated by the Honest OP.
Bitbucket status: closed
Bitbucket origin: issue 78
This is an attack listed in the report SoK: Single Sign-On Security – An Evaluation of OpenID Connect.
In this test, the Attacker OP returns maliciously crafted Discovery document and afterward to create an ID Token containing the identity of the victim, which is controlled by another OP – Honest OP.
Prerequisite
Execution
The Attacker OP returns the following configuration during the Discovery phase.
Result Evaluation
The goal of this test is to verify whether the End-User authentication can be broken. The attack is successful if the Attacker OP receives any secret information, for example, client_id, client_secret, code or access token, generated by the Honest OP.
Bitbucket status: closed
Bitbucket origin: issue 78