Page MenuHomePhabricator

Restricting OpenID using $wgOpenIDConsumerAllow can be bypassed
Closed, ResolvedPublic

Description

Author: craig.box

Description:
Picture this situation:

LocalSettings.php:

  1. Deny all OpenIDs except the ones we allow: $wgOpenIDConsumerDenyByDefault = true; $wgOpenIDConsumerAllow = array("@^(http://)?mydomain.com@");

Someone enters in http://mydomain.com/ - validation passes - all is good.

Then, then take the URL that their browser is redirected to (I used Firefox's Live HTTP Headers plugin to see this), copy the OpenID parameters off it, and then suffix them onto a server which they have an account on (say, https://login.launchpad.net/+openid).

Voila, I am logged into this supposedly-restricted wiki with an OpenID that fails the consumer allow test.

Two things come to mind here:

  • Aren't OpenID requests meant to be signed, so they can't be tampered with in this way?
  • You should validate after the OpenID is returned, not (just) before.

For example, I have solved this by adding to SpecialOpenIDFinish.body.php

			 case Auth_OpenID_SUCCESS:
				// This means the authentication succeeded.
				$openid = $response->getDisplayIdentifier();
				// Check we have been given an identifier we accept.
				if (!$this->canLogin($openid_url)) {
					$wgOut->showErrorPage('openidpermission', 'openidpermissiontext');
					return;
				}

However, I don't think this will stop a OP that is prepared to issue an ID in any name - only signing will fix that.


Version: unspecified
Severity: critical

Details

Reference
bz22108

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 10:58 PM
bzimport set Reference to bz22108.

craig.box wrote:

Andrew Arnott from DotNetOpenAuth has explained the situation to me here.

In summary, the RP library should stop the "ID issued in any name" case, by signature verification, so the only thing we need to do is check that the assertion is acceptable with the code above.

However, we shouldn't be checking the display identifier, which can be set to whatever you want - we should be checking the identity_url. See http://openidenabled.com/files/php-openid/docs/2.1.3/OpenID/Auth_OpenID_ConsumerResponse.html.

Patch forthcoming...

craig.box wrote:

Security fix for issue 22108

Here is the patch.

Note, I am now checking identity_url rather than displayIdentifier; the user can set the display identifier, so you shouldn't ever check it (e.g. I could set up a provider to give out the ID http://badprovider.com/me but the display identifier set to http://impersonatedprovider.com/you.

Attached:

sergey.chernyshev wrote:

I applied it in r61601 to current trunk. Please test it - I didn't have time to set up testing environment for this problem, unfortunately.

craig.box wrote:

Tests OK for me.