2

I've searched a lot online but with no use. I want to know what could the attacker do if he obtains the client_id and client_secret of an Google's Oauth2 app. Like what the information he would be able to see? Can he edit the app configurations? Can he see other people information?

I haven't worked with Oauth2.0 before so please make your answer simple

Thanks!

Ahmed Ezzat
  • 65
  • 10

1 Answers1

3

I want to know what could the attacker do if he obtains the client_id and client_secret of an Google's Oauth2 app.

The OAuth 2 Client Secret must be protected. However, if it is leaked the attacker needs one more item. A valid redirect_uri. If the attacker has both along with the (public) Client ID, they might be able to generate OAuth tokens for your account.

The redirect_uri is often valid for http://localhost because developers forget to remove this URI after development completes. This means that someone could run a local server and generate OAuth tokens. This is a big security hole.

What can they do with the OAuth tokens? depends ...

Like what the information he would be able to see? Can he edit the app configurations? Can he see other people information?

You did not specify whose OAuth system, what it is authorizing, etc. Therefore the answer is "it depends".

For Google Cloud, the hacker will need the credentials for someone authorized in Google Cloud. Some systems have very poor security, so as they say, anything can happen and often does with poorly designed security.

In a properly designed system, there are several layers that the hacker needs to get thru. Having the Client Secret helps a lot, but is not a total security failure. The hacker can only authenticate with the system. The next layer, which is authorization, needs to be breached. In a correctly designed system, the hacker will need to authenticate with a user with authorized permissions. If the hacker has that, then you are in big trouble. He might have the keys to do anything he wants. Again, it depends.

John Hanley
  • 74,467
  • 6
  • 95
  • 159
  • `A valid redirect_uri` is pretty easy to obtain; however a redirect_uri that would redirect to the attackers server would be a huge Oauth server misconfiguration. – raven Oct 06 '21 at 08:14
  • @raven - The attacker's server could be localhost which is often configured during development. To set up a public URL would require editing the OAuth provider configuration. – John Hanley Oct 06 '21 at 15:34
  • @JohnHanley Couldn't an attacker still point to your valid redirect URI and DOS your API account? – KinsDotNet Dec 20 '22 at 17:25
  • @KinsDotNet - The attacker needs to know the Client ID and Client Secret. If they have the Client Secret and valid user credentials, you might have a problem. However, the OAuth service provider would validate user authentication before calling the redirect URI. That means a lot of resources would be required to perform a DoS against a provider such as Google. – John Hanley Dec 20 '22 at 21:37