Salt Security has announced the release of its new OAuth protection package to detect attempts to exploit OAuth and proactively fix vulnerabilities.
Salt claims that it is enhancing its API protection platform with a comprehensive suite of new OAuth threat detections and posture rules to address the growing challenge of OAuth exploitation.
The company also believes it is the first API security vendor to launch deep OAuth threat detection capabilities and these innovations will empower organisations to identify and mitigate malicious attempts to exploit OAuth flows, ultimately safeguarding sensitive data and user accounts.
Today, OAuth is an important part of modern authorisation frameworks, granting access to resources across different applications easily. However, vulnerabilities in OAuth implementations can create significant security risks.
By implementing strong OAuth security controls, organisations can safeguard their users’ data, prevent unauthorised access to critical resources and maintain user trust.
Salt Security’s recent investigation exposed several critical security flaws within the OAuth implementations of popular ChatGPT plug-ins. ChatGPT plugins enable ChatGPT to interact with the outside world and third-party websites like Google Drive, GitHub, Emails and more.
Beyond this most recent example of OAuth threats with ChatGPT, the Salt Labs team found several other OAuth-specific exploitable vulnerabilities within Booking.com, Grammarly, Vidio.com, and Expo/CodeCademy, indicating the critical need for tools to help find and mitigate these types of risks before attackers can take advantage.
These real-world examples underscore the importance of robust security measures to thwart sophisticated OAuth attack tactics before they can inflict significant damage.
With these new capabilities, the Salt platform will address:
Access Token and Authorisation Code Theft: Vulnerabilities in OAuth systems can leave access tokens or authorisation codes susceptible to theft. Attackers can leverage those stolen elements to impersonate legitimate users and gain unauthorised access to sensitive resources and applications.
Increasing OAuth Attacks: OAuth has been in widespread use for over a decade but we have seen attacks on the rise. This is caused by organisations’ increased usage of APIs and microservices making OAuth even more popular while increasing the complexity of securing it. Attackers have taken advantage of this by crafting specific OAuth-based attacks with continuing attempts to find additional OAuth vulnerabilities to exploit.
“Organisations that demonstrate a commitment to robust security practices foster user confidence and enhance brand reputation, leading to stronger customer relationships and a competitive edge in the marketplace,” said Yaniv Balmas, Vice President of Research, Salt Security. “With the rise in OAuth specific vulnerabilities, it is vital for organisations to incorporate robust security measures to thwart sophisticated OAuth attack tactics before they can inflict significant damage.
“By implementing strong OAuth security controls, organisations can safeguard their users’ data, prevent unauthorised access to critical resources and maintain user trust.”
To read more news from Eskenzi PR, click here.
