DigiLocker's OAuth authorization screen trusted unvalidated base64-encoded app_name and partner_name query parameters. An attacker could construct malicious OAuth links displaying trusted banking names to deceive users during Aadhaar authorization.
🔍 Recently, I delved into the depth of Digilocker integration, specifically examining the OAuth flow. OAuth, a crucial component, facilitates user authorisation and resource owner authentication.
🔐 During this exploration, I stumbled upon a significant security concern. The login screen prompts users to input their Aadhaar number, displaying the client's branding—app name and organisation name—associated with Digilocker.
🔍 Upon inspecting the OAuth initiation URL, I discovered parameters named app_name and partner_name, both base64 encoded and rendered directly on the OAuth screen without any server-side validation.
🚨 This poses a serious potential threat, as other clients could exploit this flaw to impersonate legitimate entities like banking institutions. By encoding their name in base64 and adding it to the parameters, they could mislead users into divulging sensitive information.
🛡️ The proposed solution to this critical issue is for Digilocker to fetch and render the app and organization names using the verified data collected during the client's registration process, rather than relying on query parameters.
🌐 The gravity of this situation cannot be overstated. Addressing this security loophole is imperative to ensure the integrity and trustworthiness of the Digilocker integration platform.