Document possible phishing attacks during authentication with Solid-OIDC #6

Activity

1. jg10-mastodon-social commented on Nov 22, 2025

   

   jg10-mastodon-social

   on Nov 22, 2025

   Last edited by jg10-mastodon-social

   More actions

   Based on elf-pavlik/mallory#1

   Here's an attack where clientid redirect uris are compromised when stored on solid storage.
   Potentially the only sign that the app is malicious would be the URL of the app.

   • We have an app owner of a vulnerable app
   • We have a target user who's authenticated session

   1. Preconditions
      • The vulnerable app uses a client id document that the app owner has write access to
      • The app owner's server does not restrict write access by app
   2. The attacker socially engineers the app owner to login in to a malicious app, which now has write privileges to the client id document
   3. The malicious app modifies the vulnerable app's client id, adding the malicious app to redirect_uris
   4. The malicious app is configured to use the attacked client id
   5. The attacker socially engineers the target user to login in the malicious app.
   6. When logging in, the target user is presented with a consent screen showing a legitimate client id
   7. The malicious app obtains a logged in session

   ---

   Edit:

   I would say that the security issue in this case is that people have misplaced confidence in that client id.
   A malicious app can similarly mimic apps that use dynamic registration, but in that case confidence in the app is based on the URL they were redirected from.

   This phishing attack also has the additional attack consequence that the malicious app can impersonate the vulnerable app when using client authorization.