Zero-day in Sign in with Apple bhavukjain.com/blog/2020/05/…
6
8
2
28
if I understand correctly, the token request accepted an alternative email claim value and used it to override the value on Apple’s IDP. Really?
2
1
1
If I'm reading it right it's not the token endpoint, it's their internal API for accepting the request that let the user choose which email to share with the app. So it's a form validation problem.
1
But it’s exposed to the client and did accept arbitrary values, right?
2
Replying to @tlodderstedt @leastprivilege
Yea, it's just not part of the OAuth API. It's more like bad logic on the internal implementation of the AS.

May 31, 2020 · 12:39 PM UTC

2
1
Replying to @aaronpk @tlodderstedt @leastprivilege
Seen similar issues with SAML in the past. SP correctly verified the assertion, then redirected the user to the real app path with his email address as (exchangeable) parameter. On IdP/AS side it’s of course even more severe...
1
Replying to @aaronpk @leastprivilege
I see. Thanks for the clarification.