[CRITICAL] Steam OpenID implementation allows spoofing

[bommels]

I am using the latest version of social-core and social-app-django.

Expected behaviour

Steam OpenID redirects from a different server than 'https://steamcommunity.com/openid/login' should not get authenticated.

Actual behaviour

Spoofing the OpenID server (by for example, hosting your own), and redirecting to the /complete/ endpoint authenticates the user. There is no check on claimed_id, identity and op_endpoint.

What are the steps to reproduce this issue?

1. Try to auth through Steam
2. Authenticate with your Steam account, capture the redirect url (.../complete/steam...)
3. Replace steamcommunity.com in the URL with your own OpenID host
4. You will be authenticated

You can let your own OpenID instance return any steam id you want to authenticate as that steam id/user. I have tested this, and could successfully authenticate as any steam user.

Any other comments?

I fixed this issue locally by implementing the following and adding it to the auth pipeline, I am not 100% sure if this covers the bug fully.

def steam_auth_check(*args, **kwargs):
    if kwargs['response'].message.args[('http://specs.openid.net/auth/2.0', 'claimed_id')][0:27] != 'https://steamcommunity.com/':
        raise Exception('Authentication Mismatch')
    if kwargs['response'].message.args[('http://specs.openid.net/auth/2.0', 'identity')][0:27] != 'https://steamcommunity.com/':
        raise Exception('Authentication Mismatch')
    if kwargs['response'].message.args[('http://specs.openid.net/auth/2.0', 'op_endpoint')] != 'https://steamcommunity.com/openid/login':
        raise Exception('Authentication Mismatch')

[nijel]

The Steam backend was intentionally made stateless in d975841, maybe that no longer applies these days. Can you try removing the consumer method from SteamOpenId and chech whether it works well then?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.