A vulnerability found recently in an OpenID-based feature of the Mozilla Persona online-identity management service prompted the company to advise web developers to check their OpenID implementations for similar issues.
Mozilla Persona allows users to verify their ownership of one or more email addresses and then use those addresses to authenticate on websites. Users have to remember only their Persona account password, because once they’re logged into the service, authenticating on Persona-enabled websites only takes two mouse clicks.
To verify email addresses for use with Persona users typically have to click on a link sent to those addresses, except for Gmail and Yahoo addresses which are verified through what Mozilla calls “Identity Bridging,” a feature based on the OpenID authentication protocol.
Vulnerability pinpointed
It’s in this identity bridge feature that three security researchers from the University of Trier in Germany have recently found a serious vulnerability. The flaw, which was reported through the Mozilla bug bounty program and is now fixed, could have allowed an attacker to authenticate on Persona-enabled websites with the Gmail or Yahoo Mail addresses of other users.
The vulnerability had no bearing on the security of Gmail or Yahoo Mail accounts and only impacted the Persona service and websites that allow authentication based on it, Michael Coates, Mozilla’s director of security assurance, said Wednesday in a blog post.
The initial patches were deployed last Friday and some additional ones on Tuesday of this week, he said.
The problem stemmed from incorrect security and behavior assumptions with two third-party OpenID libraries, meaning that other developers who use OpenID might have made the same mistakes.
Possible attacks
Mozilla developer Lloyd Hilaiel explained two attack scenarios enabled by the issue in a separate blog post.
One involves an attacker generating a valid and signed OpenID response from an identity provider that doesn’t contain an email address field, and then appending their own email field and value to it. “This simple attack combined with behavior common in OpenID libraries can lead to vulnerabilities,” Hilaiel said.
The other attack scenario involves an attacker adding an email address field at the beginning of a response that already has a signed email address field. Depending on how the OpenID library extracts values from OpenID responses, this trick might be enough to cause the unsigned email address value to be used instead of the legitimate one.
“In a popular OpenID implementation we found a lack of rigor in value extraction that could lead to vulnerabilities of this nature,” Hilaiel said.
OpenID library authors should make sure that rigorous validation is performed on the values returned by an identity provider and that libraries clearly indicate which values are signed and can be trusted and which are not, he said. Site owners who use OpenID should also check their implementations to ensure that identifying values they rely on from OpenID responses are actually signed.