{"authors":[{"id":"orcid_______::9595abd945dfa342757d0ff321234ada","fullName":"Tommaso Innocenti","name":null,"surname":null,"rank":1,"pid":{"id":{"scheme":"orcid","value":"0000-0003-0247-806x"},"provenance":null}},{"id":"orcid_______::4b52f9f42249fb26c312a925ba7da96c","fullName":"Matteo Golinelli","name":null,"surname":null,"rank":2,"pid":{"id":{"scheme":"orcid","value":"0000-0002-8743-0825"},"provenance":null}},{"id":null,"fullName":"Kaan Onarlioglu","name":null,"surname":null,"rank":3,"pid":{"id":{"scheme":"orcid_pending","value":"0009-0003-7832-5884"},"provenance":null}},{"id":null,"fullName":"Seyed Ali Mirheidari","name":null,"surname":null,"rank":4,"pid":{"id":{"scheme":"orcid_pending","value":"0000-0003-0159-5037"},"provenance":null}},{"id":"orcid_______::523a27c7b8617d3be78bc490d9d7b97d","fullName":"Bruno Crispo","name":null,"surname":null,"rank":5,"pid":{"id":{"scheme":"orcid","value":"0000-0002-1252-8465"},"provenance":null}},{"id":null,"fullName":"Engin Kirda","name":null,"surname":null,"rank":6,"pid":{"id":{"scheme":"orcid_pending","value":"0000-0001-9988-6873"},"provenance":null}}],"openAccessColor":null,"publiclyFunded":false,"eoscIfGuidelines":null,"type":"publication","language":{"code":"und","label":"Undetermined"},"countries":[{"code":"IT","label":"Italy","provenance":null}],"subjects":[{"subject":{"scheme":"FOS","value":"0202 electrical engineering, electronic engineering, information engineering"},"provenance":null},{"subject":{"scheme":"keyword","value":"account takeover; OAuth 2.0; parameter pollution; path confusion; redirect URI;"},"provenance":null},{"subject":{"scheme":"FOS","value":"02 engineering and technology"},"provenance":null}],"mainTitle":"OAuth 2.0 Redirect URI Validation Falls Short, Literally","subTitle":null,"descriptions":["OAuth 2.0 requires a complex redirection trail between websites and Identity Providers (IdPs). In particular, the “redirect URI” parameter included in the popular Authorization Grant Code flow governs the callback endpoint that users are routed to, together with their security tokens. The protocol specification, therefore, includes guidelines on protecting the integrity of the redirect URI. In this work, we analyze the OAuth 2.0 specification in light of modern systems-centric attacks and reveal that the prescribed redirect URI validation guidance exposes IdPs to path confusion and parameter pollution attacks. Based on this observation, we propose novel attack techniques and experiment with 16 popular IdPs, empirically verifying that the OAuth 2.0 security guidance is under-specified. We finally present end-to-end attack scenarios that combine our attack techniques with common web application vulnerabilities, ultimately resulting in a complete compromise of the secure delegated access that OAuth 2.0 promises."],"publicationDate":"2023-12-04","publisher":"ACM","embargoEndDate":null,"sources":["Crossref"],"formats":["application/pdf"],"contributors":null,"coverages":null,"bestAccessRight":{"code":"c_abf2","label":"OPEN","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/"},"container":{"name":"Annual Computer Security Applications Conference","issnPrinted":null,"issnOnline":null,"issnLinking":null,"ep":"267","iss":null,"sp":"256","vol":null,"edition":null,"conferencePlace":null,"conferenceDate":null},"documentationUrls":null,"codeRepositoryUrl":null,"programmingLanguage":null,"contactPeople":null,"contactGroups":null,"tools":null,"size":null,"version":null,"geoLocations":null,"id":"doi_dedup___::a8cb24203f67f17f74cb71d899f1d7d8","originalIds":["10.1145/3627106.3627140","10.1145/3627106","50|doiboost____|a8cb24203f67f17f74cb71d899f1d7d8","50|dblp________::5ede443f5c77582ac5202c8c747eb934","oai:iris.unitn.it:11572/399070","50|od______3432::17048ec4db1b256bda6dc398f6243b40"],"pids":[{"scheme":"doi","value":"10.1145/3627106.3627140"},{"scheme":"handle","value":"11572/399070"}],"dateOfCollection":null,"lastUpdateTimeStamp":null,"indicators":{"citationImpact":{"citationCount":7.0,"influence":2.659409E-9,"popularity":6.288967E-9,"impulse":7.0,"citationClass":"C5","influenceClass":"C5","impulseClass":"C4","popularityClass":"C4"}},"projects":[{"id":"nsf_________::7b2f46b09df2e44c462a61d21d6d0f67","code":"2219921","acronym":null,"title":"Collaborative Research: EAGER: Understanding User Needs for Access Control Systems in Smart Settings","funder":"National Science Foundation","pids":null},{"id":"corda_____he::9ce4795c43250f481c709ae85d41b183","code":"101086308","acronym":"DUCA","title":"Data Usage Control for empowering digital sovereignty for All citizens","funder":"European Commission","pids":[{"scheme":"doi","value":"10.3030/101086308"}]},{"id":"nsf_________::f2330e30b9b0e25623915e163928d3bf","code":"2329540","acronym":null,"title":"SaTC: CORE: Medium: Securing WebAssembly using Static Analysis and Binary Instrumentation","funder":"National Science Foundation","pids":null},{"id":"nsf_________::d36444dbc34260d03f0b86796117c064","code":"2127200","acronym":null,"title":"Collaborative Research: SaTC: CORE: Small: Flanker: Automatically Detecting Lateral Movement in Organizations Using Heterogeneous Data and Graph Representation Learning","funder":"National Science Foundation","pids":null}],"organizations":[{"legalName":"Northwestern University","acronym":"NU","id":"openorgs____::1ec8a971a88d917104824730cbd7b586","pids":[{"scheme":"ISNI","value":"0000000090038934"},{"scheme":"wikidata","value":"Q309350"},{"scheme":"FundRef","value":"100015257"},{"scheme":"FundRef","value":"100011764"},{"scheme":"fundref","value":"100007291"},{"scheme":"GRID","value":"grid.441344.2"},{"scheme":"ISNI","value":"0000000404163245"},{"scheme":"OrgRef","value":"422926"},{"scheme":"OrgRef","value":"6372366"},{"scheme":"FundRef","value":"100017796"},{"scheme":"FundRef","value":"100011755"},{"scheme":"fundref","value":"100007059"},{"scheme":"wikidata","value":"Q7060260"},{"scheme":"Wikidata","value":"Q7060132"},{"scheme":"wikidata","value":"Q37548"},{"scheme":"Wikidata","value":"Q2000943"},{"scheme":"ROR","value":"https://ror.org/000e0be47"},{"scheme":"ROR","value":"https://ror.org/00y7snj24"},{"scheme":"OrgRef","value":"4015130"},{"scheme":"wikidata","value":"Q2000943"},{"scheme":"OrgRef","value":"633572"},{"scheme":"OrgRef","value":"385997"},{"scheme":"Wikidata","value":"Q309350"},{"scheme":"ISNI","value":"0000000122993507"},{"scheme":"ISNI","value":"0000000100293948"},{"scheme":"fundref","value":"100017796"},{"scheme":"OrgRef","value":"3893597"},{"scheme":"GRID","value":"grid.261175.6"},{"scheme":"GRID","value":"grid.16753.36"},{"scheme":"ROR","value":"https://ror.org/012wxa772"},{"scheme":"Wikidata","value":"Q37548"},{"scheme":"OrgRef","value":"5024816"},{"scheme":"wikidata","value":"Q1191344"},{"scheme":"ISNI","value":"0000000121733359"},{"scheme":"wikidata","value":"Q7060132"},{"scheme":"OrgRef","value":"987249"},{"scheme":"fundref","value":"100013826"},{"scheme":"FundRef","value":"100007059"},{"scheme":"FundRef","value":"100013826"},{"scheme":"Wikidata","value":"Q7060260"},{"scheme":"ROR","value":"https://ror.org/019t2rq07"},{"scheme":"GRID","value":"grid.441153.6"},{"scheme":"OrgRef","value":"293498"},{"scheme":"wikidata","value":"Q7060296"},{"scheme":"GRID","value":"grid.462972.c"},{"scheme":"Wikidata","value":"Q7060296"},{"scheme":"Wikidata","value":"Q1191344"},{"scheme":"OrgRef","value":"12647261"},{"scheme":"ISNI","value":"0000000404669414"},{"scheme":"PIC","value":"999627778"},{"scheme":"fundref","value":"100011755"},{"scheme":"mag_id","value":"111979921"},{"scheme":"GRID","value":"grid.261128.e"},{"scheme":"fundref","value":"100008250"},{"scheme":"ROR","value":"https://ror.org/04xf6c905"},{"scheme":"FundRef","value":"100007058"},{"scheme":"ISNI","value":"0000000098144678"},{"scheme":"OrgRef","value":"174216"},{"scheme":"FundRef","value":"100011249"},{"scheme":"wikidata","value":"Q7057736"},{"scheme":"ROR","value":"https://ror.org/04t5xt781"},{"scheme":"FundRef","value":"100008250"},{"scheme":"fundref","value":"100011764"},{"scheme":"Wikidata","value":"Q7057736"},{"scheme":"ROR","value":"https://ror.org/01bry7z39"},{"scheme":"GRID","value":"grid.261108.c"},{"scheme":"OrgRef","value":"16601408"},{"scheme":"GRID","value":"grid.261112.7"},{"scheme":"ROR","value":"https://ror.org/04edns687"},{"scheme":"ISNI","value":"0000000107501797"},{"scheme":"fundref","value":"100015257"},{"scheme":"FundRef","value":"100007291"},{"scheme":"fundref","value":"100007058"}],"countries":[{"code":"US","label":"United States"}],"websiteurl":"http://www.northwestern.edu/"},{"legalName":"Northeastern University","acronym":"NEU","id":"openorgs____::d847cfae048db6985b5f5edab6ffd57c","pids":[{"scheme":"PIC","value":"998448064"},{"scheme":"OrgRef","value":"4015130"},{"scheme":"OrgRef","value":"385997"},{"scheme":"Wikidata","value":"Q37548"},{"scheme":"ISNI","value":"0000000121733359"},{"scheme":"mag_id","value":"12912129"},{"scheme":"ROR","value":"https://ror.org/04t5xt781"},{"scheme":"GRID","value":"grid.261112.7"}],"countries":[{"code":"US","label":"United States"}],"websiteurl":"http://www.northeastern.edu/"},{"legalName":"Trent University","acronym":"Trent University","id":"openorgs____::78eead4506ef6cdebcd459f4b234c52a","pids":[{"scheme":"FundRef","value":"501100000184"},{"scheme":"Wikidata","value":"Q3075124"},{"scheme":"OrgRef","value":"261859"},{"scheme":"wikidata","value":"Q3075124"},{"scheme":"GRID","value":"grid.52539.38"},{"scheme":"PIC","value":"994387935"},{"scheme":"fundref","value":"501100000184"},{"scheme":"ISNI","value":"0000000110902022"},{"scheme":"mag_id","value":"662221"},{"scheme":"ROR","value":"https://ror.org/03ygmq230"}],"countries":[{"code":"CA","label":"Canada"}],"websiteurl":"http://www.trentu.ca/"},{"legalName":"Akamai (United States)","acronym":"Akamai (United States)","id":"openorgs____::5dbfa3bf27ead2353de1bbc7ccee50b8","pids":[{"scheme":"mag_id","value":"10734018"},{"scheme":"ROR","value":"https://ror.org/03tarb191"},{"scheme":"GRID","value":"grid.497049.7"},{"scheme":"ISNI","value":"0000000463624072"}],"countries":[{"code":"US","label":"United States"}],"websiteurl":"https://www.akamai.com/"},{"legalName":"University of Trento","acronym":"University of Trento","id":"openorgs____::db652e6496b6c6a08d25533f27864d04","pids":[{"scheme":"ROR","value":"https://ror.org/05trd4x28"},{"scheme":"OrgRef","value":"1949698"},{"scheme":"fundref","value":"501100004004"},{"scheme":"OrgReg","value":"IT0085"},{"scheme":"GRID","value":"grid.11696.39"},{"scheme":"ISNI","value":"0000000419370351"},{"scheme":"wikidata","value":"Q930528"},{"scheme":"Wikidata","value":"Q930528"},{"scheme":"mag_id","value":"193223587"},{"scheme":"FundRef","value":"501100004004"},{"scheme":"PIC","value":"999841954"}],"countries":[{"code":"IT","label":"Italy"}],"websiteurl":"http://www.unitn.it/en"}],"communities":[{"code":"eu-conexus","label":"European University for Smart Urban Coastal Sustainability","provenance":null},{"code":"uarctic","label":"UArctic","provenance":null}],"collectedFrom":[{"key":"opendoar____::72007983849f4fcb0ad565439834756b","value":"IRIS - Institutional Research Information System of the University of Trento"},{"key":"openaire____::081b82f96300b6a6e3d282bad31cb6e2","value":"Crossref"},{"key":"openaire____::d8b68cc0a53121f6f896883a7d60c1db","value":"DBLP"}],"instances":[{"pids":[{"scheme":"doi","value":"10.1145/3627106.3627140"}],"license":"https://www.acm.org/publications/policies/copyright_policy#Background","accessRight":{"code":"c_14cb","label":"CLOSED","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/","openAccessRoute":null},"type":"Article","urls":["https://doi.org/10.1145/3627106.3627140"],"publicationDate":"2023-12-04","refereed":"peerReviewed","hostedBy":{"key":"openaire____::55045bd2a65019fd8e6741a755395c8c","value":"Unknown Repository"},"collectedFrom":{"key":"openaire____::081b82f96300b6a6e3d282bad31cb6e2","value":"Crossref"}},{"alternateIdentifiers":[{"scheme":"doi","value":"10.1145/3627106.3627140"}],"type":"Conference object","urls":["https://doi.org/10.1145/3627106.3627140","https://dblp.org/rec/conf/acsac/InnocentiGOMCK23.html"],"refereed":"nonPeerReviewed","hostedBy":{"key":"openaire____::d8b68cc0a53121f6f896883a7d60c1db","value":"DBLP"},"collectedFrom":{"key":"openaire____::d8b68cc0a53121f6f896883a7d60c1db","value":"DBLP"}},{"pids":[{"scheme":"handle","value":"11572/399070"}],"alternateIdentifiers":[{"scheme":"urn","value":"W4389279196"},{"scheme":"urn","value":"2-s2.0-85180150107"},{"scheme":"doi","value":"10.1145/3627106.3627140"}],"accessRight":{"code":"c_abf2","label":"OPEN","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/","openAccessRoute":null},"type":"Conference object","urls":["https://doi.org/10.1145/3627106.3627140","https://dl.acm.org/doi/10.1145/3627106.3627140","https://hdl.handle.net/11572/399070"],"publicationDate":"2023-01-01","refereed":"nonPeerReviewed","hostedBy":{"key":"opendoar____::72007983849f4fcb0ad565439834756b","value":"IRIS - Institutional Research Information System of the University of Trento"},"collectedFrom":{"key":"opendoar____::72007983849f4fcb0ad565439834756b","value":"IRIS - Institutional Research Information System of the University of Trento"}}],"links":[{"header":{"relationType":"resultProject","relationClass":"isProducedBy","relatedIdentifier":"nsf_________::7b2f46b09df2e44c462a61d21d6d0f67","relatedRecordType":"project","relationProvenance":"iis","trust":"0.7348"},"collectedfrom":[{"dsId":"openaire____::dd69b4a1513c9de9f46faf24048da1e8","dsName":"NSF - National Science Foundation"}],"projectTitle":"Collaborative Research: EAGER: Understanding User Needs for Access Control Systems in Smart Settings","code":"2219921","funding":{"funder":{"id":"nsf_________::NSF","shortname":"NSF","name":"National Science Foundation","jurisdiction":{"code":"US","label":"United States"},"pid":null},"level0":{"id":"nsf_________::NSF::CISE/OAD","description":"Directorate for Computer & Information Science & Engineering","name":"Directorate for Computer & Information Science & Engineering"},"level1":{"id":"nsf_________::NSF::CISE/OAD::CISE/CNS","description":"Division of Computer and Network Systems","name":"Division of Computer and Network Systems"},"level2":{"id":null,"description":null,"name":null}},"startDate":"2022-07-15","endDate":"2024-06-30"},{"header":{"relationType":"resultProject","relationClass":"isProducedBy","relatedIdentifier":"corda_____he::9ce4795c43250f481c709ae85d41b183","relatedRecordType":"project","relationProvenance":"iis","trust":"0.897"},"collectedfrom":[{"dsId":"openaire____::3f264f93cf3b0cfc4ede188a6300455c","dsName":"CORDA - COmmon Research DAta Warehouse - Horizon Europe"}],"projectTitle":"Data Usage Control for empowering digital sovereignty for All citizens","code":"101086308","funding":{"funder":{"id":"ec__________::EC","shortname":"EC","name":"European Commission","jurisdiction":{"code":"EU","label":"European Union"},"pid":null},"level0":{"id":"ec__________::EC::HE","description":"Horizon Europe Framework Programme","name":"HE"},"level1":{"id":"ec__________::EC::HE::HORIZON-TMA-MSCA-SE","description":"HORIZON TMA MSCA Staff Exchanges","name":"HORIZON-TMA-MSCA-SE"},"level2":{"id":null,"description":null,"name":null}},"startDate":"2023-01-01","endDate":"2026-12-31"},{"header":{"relationType":"resultProject","relationClass":"isProducedBy","relatedIdentifier":"nsf_________::f2330e30b9b0e25623915e163928d3bf","relatedRecordType":"project","relationProvenance":"iis","trust":"0.7348"},"collectedfrom":[{"dsId":"openaire____::dd69b4a1513c9de9f46faf24048da1e8","dsName":"NSF - National Science Foundation"}],"projectTitle":"SaTC: CORE: Medium: Securing WebAssembly using Static Analysis and Binary Instrumentation","code":"2329540","funding":{"funder":{"id":"nsf_________::NSF","shortname":"NSF","name":"National Science Foundation","jurisdiction":{"code":"US","label":"United States"},"pid":null},"level0":{"id":"nsf_________::NSF::CISE/OAD","description":"Directorate for Computer & Information Science & Engineering","name":"Directorate for Computer & Information Science & Engineering"},"level1":{"id":"nsf_________::NSF::CISE/OAD::CISE/CNS","description":"Division of Computer and Network Systems","name":"Division of Computer and Network Systems"},"level2":{"id":null,"description":null,"name":null}},"startDate":"2023-10-01","endDate":"2026-09-30"},{"header":{"relationType":"resultProject","relationClass":"isProducedBy","relatedIdentifier":"nsf_________::d36444dbc34260d03f0b86796117c064","relatedRecordType":"project","relationProvenance":"iis","trust":"0.7348"},"collectedfrom":[{"dsId":"openaire____::dd69b4a1513c9de9f46faf24048da1e8","dsName":"NSF - National Science Foundation"}],"projectTitle":"Collaborative Research: SaTC: CORE: Small: Flanker: Automatically Detecting Lateral Movement in Organizations Using Heterogeneous Data and Graph Representation Learning","code":"2127200","funding":{"funder":{"id":"nsf_________::NSF","shortname":"NSF","name":"National Science Foundation","jurisdiction":{"code":"US","label":"United States"},"pid":null},"level0":{"id":"nsf_________::NSF::CISE/OAD","description":"Directorate for Computer & Information Science & Engineering","name":"Directorate for Computer & Information Science & Engineering"},"level1":{"id":"nsf_________::NSF::CISE/OAD::CISE/CNS","description":"Division of Computer and Network Systems","name":"Division of Computer and Network Systems"},"level2":{"id":null,"description":null,"name":null}},"startDate":"2021-10-01","endDate":"2024-09-30"}],"otherTitles":null,"green":true,"inDiamondJournal":false,"isGreen":true,"isInDiamondJournal":false}