Exposing the Lethal Power of the Refresh Token

Hey folks! In this writeup, I’m gonna show you how I managed to hijack user accounts by exploiting some sneaky gaps in how an app integrates with Google OAuth and Amazon Cognito. The short version is: if an app screws up how it handles your Google user_id and your tokens, you can end up taking over someone else’s account just by juggling emails and token refreshes. Let’s dig in!

Part 1: The Usual Google OAuth Flow

1. User clicks “Sign in with Google.”
   • Standard stuff: you tap that “Sign in with Google” button and complete the OAuth flow on Google’s side.
2. Cognito returns tokens.
   • The app gets back an AccessToken and an IdToken from Amazon Cognito.
   • Your Google user_id is inside that IdToken (it’s basically the sub field or something similar). This user_id is unique to your Google account and doesn’t change across apps.
3. App checks the IdToken for a username.
   • The app sees that the “username” field is actually the Google user_id.
   • If it doesn’t find any existing account linked to that Google user_id, it decides, “Okay, time to create or link a new account.”
4. App calls /v1/user/connect.
   • This endpoint links the Google user_id with the email. Also this endpoint needs:
     • A username (which is basically your Google user_id) (The Google user_id must be valid, not already tied to another account and must match the username in the IdToken).
     • An **email (**The email you pass in must match the email in the IdToken).
     • An Authorization header containing the IdToken.

Part 2: Amazon Cognito for User Management

Under the hood, the app uses Amazon Cognito to store user profiles. Here’s where it matters:

• When you change your email in the app, it calls Cognito’s UpdateUserAttributes operation with your AccessToken.

• The request looks something like this:

  POST / HTTP/1.1
  Host: cognito-idp.us-west-2.amazonaws.com
  X-Amz-Date: 20230613T200059Z
  Accept-Encoding: gzip, deflate, br
  X-Amz-Target: AWSCognitoIdentityProviderService.UpdateUserAttributes
  User-Agent: <UserAgentString>
  Authorization: AWS4-HMAC-SHA256 Credential=<Credential>, SignedHeaders=<Headers>, Signature=<Signature>
  Content-Length: <PayloadSizeBytes>
  
  {
    "AccessToken": "eyJra456defEXAMPLE",
    "UserAttributes": [
      {
        "Name": "email",
        "Value": "[email protected]"
      }
    ]
  }
  

• Cognito updates your email to "[email protected]", but the app flags your account as unverified until you confirm it.

• If you then refresh your tokens (using your RefreshToken), your new IdToken will contain this updated email—even though it’s unverified.