Not validating source of callback
See original GitHub issueThere currently is an exploit that uses the fact that surprisingly many applications are not validating the source of the identity. It’s pretty easy to fake a request to the url /auth/steam/return
in the example you have provided. I’m not claiming this is an issue in passport.js or in passport-steam package. It how ever has been a problem for multiple sites not implementing it properly and I know bug bounties have been payed in the range of tens of thousands of dollars.
As a fix I would suggest you at least update the example to contain a way to verify the source of the provided identity. Better way might be preventing fetching the identity from other servers than steam, since this passport.js strategy is specific to steam.
Not currently using passport.js for anything and am not in any way an expert, so I can’t tell you how to do it. I tested one example I was provided and I was able to “fix” the exploit by checking that identifier
in function(identifier, profile, done) {
has http://steamcommunity.com or https://steamcommunity.com instead of something else. I don’t know if identity
can be faked or not, but it did at least block the malicious url I was given as an example. How ever, as I said, I don’t really know the inner workings of passport.js or openid so I can’t say if this is enough to detect malicious user.
Issue Analytics
- State:
- Created 7 years ago
- Comments:68 (8 by maintainers)
Top GitHub Comments
@mnzt Since OpenID spec allows this (“supply any OpenID provider”), I don’t think this will be changed in packages such as
node-openid
.However, I think the fix has already been suggested - just validate the request itself.
A quick fix for anyone running this package right now would be to set
options.passReqToCallback
and then just validateop_endpoint
, e.g.:This can be done inside
passport-steam
as well.Fixed in #41 by @scholtzm
Thanks everyone!