Inflection · Report #243474

Identity Login Page Redirect Can Be Manipulated

Validstatus

highseverity

72upvotes

13 Oct 2017disclosed

Summary

The Identity.com login page could be manipulated to redirect the user to an arbitrary URL after a successful authentication.

I used this request to try login https://www.identity.com/signin?redirect_url=%2Foauth%2Fauthorize%3Fclient_id%3D241f887e145f09298fc7f3459cefa080cd7abd30b7b0192977b5bb72965e0583%26redirect_uri%3D%252Ftest-callback%26response_type%3Dcode%26scope%3Dname%2Bemail%2Bdob%26state%3DAPPLICATION_TEST
I put %40google.com after redirect_url= so the endpoint was like this &redirect_url=%40google.com%2Fclient_id%253D241f887e145f09298fc7f3459cefa080cd7abd30b7b0192977b5bb72965e0583%2526redirect_uri%253D%25252Ftest-callback%2526response_type%253Dcode%2526scope%253Dname%252Bemail%252Bdob%2526state%253DAPPLICATION_TEST
After a successfully login i redirect to google.com

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original