OneLogin, More Problems

Cybersecurity incidents are on the rise worldwide, and many organizations are struggling to keep up. Industry leader OneLogin, a trusted solution for identity management, had vulnerabilities that allowed users to access any account’s data just by using a free trial. 

But let’s go back a little…

The researchers who discovered the vulnerabilities signed up for a trial of the product. With the trial, they could set up a free tenant profile. They then proceeded to install the OneLogin AD Connect service, ConnectorService.exe, on a single Windows 11 workstation.

Using the AD connector, they discovered the API tokens used to authenticate to OneLogin’s API. 

Through a Broken Authorization vulnerability (API2:2023), they could access a private tenant JWT key. 

And a Broken Object Property Level Authorization Vulnerability (API3:2023) allowed them to get the user list.

The researchers were able to forge more JWT keys by decompiling the ConnectorService.exe .NET binary. With these keys and the user list, they could now authenticate themself as any user.

Shown below is the Attack Path the researchers took.

In addition to this access, through a Security Misconfiguration (API8:2023), the researchers found exposed AWS keys linked to OneLogin. 

With these keys, they were able to access an S3 bucket owned and managed by OneLogin, and receive logs from other tenants in that bucket. These logs also contained further customer keys such as JWT and signing keys.

Overall, OneLogin was supposed to be a platform for identity and access management, but it failed at one of the most critical pillars of cybersecurity: Authorization. 

For the last decade, Authentication and Authorization have consistently competed for first place as the leading vulnerabilities that cause breaches. Many organizations make the mistake of focusing on one and not the other, or of trying to combine them both, but as we’ve discussed before, they are separate entities and better off apart.

Cybersecurity is a complex beast with many different aspects to secure. FireTail is here to help. If you want to learn more, schedule a demo or join our free tier, today.