Your Identity Is Mine: Techniques & Insights From OS Identity Providers Research
summary
Research demonstrates two concrete exploit chains: on Keycloak a single-packet attack over HTTP/2 using Burp Repeater and TLS secret extraction defeats API limits to create five clients while a token is limited to two; this becomes CVE-2024-42490. On Authentik an ORM Leak pattern plus an event-log regex oracle exposes certificate UUIDs and private keys, then an API token update that sets the user ID escalates a normal account to admin (CVE-2024-37905). Demos work end-to-end and vendors patch the issues.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 1:53Keycloak research overview
- 9:35Keycloak race condition demo
- 16:24Authentic research overview
- 22:36Authentic private key leak demo
- 23:54Authentic privilege escalation demo
- 27:19Session summary and takeaways
- 29:06Q&A session
related talks
53mOAuth2/OIDC security weaknesses and pitfalls
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
30mInsecurity protocols: an overview of modern authentication
46mFixing authentication and authorization
37mCustomer Identity for Modern Apps and APIs
40mModern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?
31mIdentity Theft: Attacks on SSO Systems
01h 12mIdentity 2.0: the what, why and how of social and federated login