Salt Security have announced the release of its new multi-layered OAuth protection package to detect attempts to exploit OAuth and proactively fix vulnerabilities. Salt is enhancing its API protection platform with a comprehensive suite of new OAuth threat detections and posture rules to address the growing challenge of OAuth exploitation. The company is the first API security vendor to launch deep OAuth threat detection capabilities, and these innovations will empower organisations to identify and mitigate malicious attempts to exploit OAuth flows, ultimately safeguarding sensitive data and user accounts.
Today, OAuth is an important part of modern authorisation frameworks, granting access to resources across different applications easily. However, vulnerabilities in OAuth implementations can create significant security risks. By implementing strong OAuth security controls, organisations can safeguard their users’ data, prevent unauthorised access to critical resources, and maintain user trust.
Salt Security’s recent investigation exposed several critical security flaws within the OAuth implementations of popular ChatGPT plug-ins. ChatGPT plugins enable ChatGPT to interact with the outside world and third-party websites like Google Drive, GitHub, Emails, and more. Beyond this most recent example of OAuth threats with ChatGPT, the Salt Labs team found several other OAuth-specific exploitable vulnerabilities within Booking.com, Grammarly, Vidio.com, and Expo/CodeCademy, indicating the critical need for tools to help find and mitigate these types of risks before attackers can take advantage. These real-world examples underscore the importance of robust security measures to thwart sophisticated OAuth attack tactics before they can inflict significant damage.
With these new capabilities, the Salt platform will address access token and authorisation code theft, as well as increasing OAuth attacks.
Salt Security’s OAuth Protection Package provides robust OAuth defences that help organisations achieve several critical security objectives. With these enhancements, customer accounts, intellectual property and authorisation tokens will be shielded from malicious actors who are tirelessly at work attempting to exploit vulnerabilities in OAuth implementations. In fact, within just five days of the OAuth protection package being deployed for Salt customers, it detected an OAuth vulnerability within a large financial institution. With the information on the detection, the customer was able to rapidly fix the vulnerability, preventing it from being exploited by threat actors.
“Organisations that demonstrate a commitment to robust security practices foster user confidence and enhance brand reputation, leading to stronger customer relationships and a competitive edge in the marketplace,” said Yaniv Balmas, Vice President of Research, Salt Security. “With the rise in OAuth specific vulnerabilities, it is vital for organisations to incorporate robust security measures to thwart sophisticated OAuth attack tactics before they can inflict significant damage. By implementing strong OAuth security controls, organisations can safeguard their users’ data, prevent unauthorised access to critical resources, and maintain user trust.”