How We Exploited Auth0 Misconfigurations
Written by Yuval Donana on
How We Exploited Auth0 Misconfigurations
Written by Yuval Donana on
Introduction
Auth0 is a popular Identity Provider (IDP) that secures authentication and authorization, but misconfigurations can introduce vulnerabilities.
This article explores a common, critical Auth0 misconfiguration and demonstrates a scenario where attackers can exploit it to gain unauthorized system access.
What is Auth0?
It is a comprehensive identity platform that empowers developers to incorporate secure authentication and authorization services into their applications seamlessly. Auth0, as an Identity Provider (IDP), simplifies user identity management by handling registration, login, password management, multi-factor authentication, and single sign-on (SSO) across multiple platforms. It supports popular identity protocols such as OpenID Connect, OAuth 2.0, and SAML, making it compatible with multiple applications.
How Does Auth0 Work?
Auth0 work by providing centralized authentication and authorization services for applications. When a user logs in to an application that uses Auth0, the application redirects the user to Auth0’s login page. It then authenticates the user and returns an access token to the application. The application can then use the access token to authorize the user to access protected resources.
How We Accessed The Restricted System
The Scenario
This scenario explores a potential bypass in a web application using Auth0 IDP with registration disabled. For the proof-of-concept (PoC), we set up a simple Flask (Python) application that uses Auth0 for authentication and authorization. After a successful login, users can access and view their profile information.
When a user clicks the “Login” button displayed in the above image, the system redirects the user to the configured Auth0 login screen. The system disables registration to allow access only to authorized users.
Exploiting the Misconfiguration
When creating a new application in Auth0, the registration option is enabled by default. Consequently, attackers may bypass registration restrictions in systems using Auth0 with registration disabled.
While exploring the Auth0 authentication API documentation, we found a key endpoint—POST /dbconnections/signup—that allows user sign-ups via the API. This endpoint requires the following parameters:
- client_id – The client_id parameter is a unique identifier that identifies an application requesting access to Auth0 services.
- connection – The connection parameter in the Auth0 authentication API specifies which identity provider to use when a user logs in. It also determines the identity provider applied when the user signs up for the application.
- email – The user’s email address.
- password – The password parameter is the user’s desired password. The password should adhere to the password policy configured by the developer at the Auth0 dashboard.
It is possible to obtain the client_id and connection parameter values relevant to the system’s environment, it can be done in several ways. For example, by attempting to authenticate to the system using invalid credentials intentionally, which passes those parameters automatically in the request:
After obtaining the client_id and the connection parameters, we can proceed to the next step and check whether the system supports registration via the Auth0 API. In order to accomplish this, we can send the previously mentioned POST /dbconnections/signup request along with the suitable parameters mentioned above, which appear to work successfully in our scenario:
In this stage, we can carry on to the login page and attempt to authenticate to the system using the newly created user, thus bypassing the restriction imposed by the application registration mechanism.
Mitigation
If you have encountered the above scenarios, please follow the instructions below provided by Clear Gate for immediate mitigation and to prevent unauthorized access to your system:
To prevent this, enable the “Disable Sign Ups” option in your database by going to Authentication → Database Connections → {YourApplicationDatabaseName} → Disable Sign-Ups.
After performing this action, an attacker will receive the following error message when attempting to register via the Auth0 API:
Conclusion
Auth0 is a robust and widely adopted Identity Provider (IDP) solution, streamlining secure authentication and authorization for applications. However, as with any complex system, potential misconfigurations can arise, leading to security vulnerabilities. In this article, we explored a specific scenario where a misconfiguration in an application utilizing Auth0 IDP allowed for a critical circumvent of the registration restriction.
By using this API and the required parameters, attackers could bypass the disabled registration and create new users, even when public sign-ups were blocked. Enabling the “Disable Sign-Ups” feature mitigates this flaw and prevents unauthorized user creation via the API.
Organizations should prioritize cyber security risk assessments and penetration tests to mitigate risks in it’s deployments, which have become increasingly popular among companies developing SaaS products. Clear Gate, a trusted cybersecurity provider, offers in-depth manual penetration tests to help organizations strengthen their Auth0 security and protect valuable data from potential threats.