1-Click Account Takeover via Open Redirect through Regex Bypass in Domain Validation
Summary
Hello there,
During my security research, I identified a critical vulnerability chain that allows an attacker to achieve full account takeover of any Khan Academy user. The attack exploits an unescaped dot flaw in the KA_DOMAIN_REGEX regular expression used to validate redirect URLs, combined with the transfer auth token mechanism used in the cross-domain authentication.
When a user is redirected to a different Khan Academy subdomain after login, the application generates a one-time transfer auth token and passes it in the URL. By exploiting the regex flaw, an attacker can register a domain that passes the validation check, causing the victim's transfer auth token to be sent to an attacker-controlled server. The attacker then replays this token on any legitimate Khan Academy domain to obtain a full session (KAAS, KAAL, KAAC cookies) as the victim.