Issue 281: OneLogin leaks secrets, Cloudflare API DoS, Entra ID flaw, OWASP BOPLA bugs
Brief
This week: we share a report about OneLogin suffering an API data leak, we also have Cloudflare’s postmortem on an accidental API DoS. We look at researcher Dirk-jan Mollema’s disclosure of a critical Entra ID vulnerability, also incidents of mass assignment and excessive data exposure in Rancher and Apache Airflow APIs, and finally Nokia platforms hit by authentication bypass via malicious API headers.
Vulnerability: Secrets Leaked by OneLogin API
Researchers at Clutch Security disclosed an incident involving excessive data exposure in OneLogin’s Identity and Access Management (IAM) platform.
The vulnerable API endpoint is designed to list all OpenID Connect applications configured in a OneLogin tenant, and is accessible to any user with valid API credentials. But the researchers found that the response also included the client_secret property in plaintext for every application.