Salt Security Discovers Flaws in Social Login Mechanism Impacting Thousands of Websites and Exposing Billions of Users to Account Takeover

Today, API security company Salt Security released new threat research from Salt Labs highlighting API security vulnerabilities uncovered in the social sign-in and Open Authentication (OAuth) implementations of multiple online companies, including Grammarly, Vidio, and Bukalapak. The flaws, which have since been remediated, could have allowed for credential leakage and enabled full account takeover (ATO). Salt Labs also reported that 1000s of other websites using social sign-in mechanisms are likely vulnerable to the same type of attack, putting billions of individuals around the globe at risk.

These findings mark the third and final research report in the Salt Labs OAuth hijacking series, following vulnerabilities uncovered in Booking.com and Expo earlier this year.

This latest research identified flaws in the access token verification step of the social sign-in process, part of the OAuth implementation on these websites. The vulnerabilities could have impacted nearly a billion user accounts across these three sites.

The vulnerabilities identified could allow cyber criminals to gain complete access to a user’s accounts on dozens of websites, potentially allowing access to sensitive data. Additionally, cybercriminals may have been able to perform any action on behalf of that user which may lead to identity theft and financial fraud.

Favoured across many websites and web services, OAuth enables a “one-click” login that lets users tap their social media accounts, such as Google or Facebook, to verify their identity and register on a site rather than set up a unique username/password combination for access. For this type of login, OAuth needs a verified token to approve access, and all three sites failed to verify the token. As a result, the Salt Labs researchers were able to insert a token from another site as a verified token and gain access to user accounts – using a technique called “Pass-The-Token Attack.”

“OAuth is one of the fastest adopted technologies in the AppSec domain and has quickly become one of the most popular protocols for both user authorisation and authentication,” said Yaniv Balmas, VP of Research, Salt Security. “The Salt Labs research illustrates the potential impacts that OAuth implementation issues can have on a business and its customers. We hope this series has helped educate the broader industry on the nature of potential OAuth implementation errors and how to close these API-based security gaps to better protect data and use OAuth more securely.”

Bukalapak is one of Indonesia’s largest and most prominent eCommerce platforms, with more than 150 million monthly users.

Bukalapak didn’t verify the access token when users registered using a social login. Therefore, by inserting a token from another website, the Salt Labs team could access a user’s credentials in bukalapak.com and completely take over that user’s account.

Grammarly.com is an AI-powered writing tool that helps users improve their writing by offering grammar, punctuation, spelling checks, and other writing tips to more than 30 million daily users.

By doing reconnaissance on the API calls and learning the terminology the Grammarly site uses to send the code, the Salt Labs team was able to manipulate the API exchange to insert code used to verify users on a different site and, again, obtain the credentials of a user’s account and achieve full account takeover.

Crucially, upon discovering the vulnerabilities on all three sites, Salt Labs’ researchers followed coordinated disclosure practices, and all issues have been remediated.

The full report, including how Salt Labs conducted this research and steps for mitigation, is available here.