full-disclosure - Facebook URL Redirect Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 28 Feb 2011 12:42:50 -0500
From: Nathan Power <np@...uritypentest.com>
To: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Facebook URL Redirect Vulnerability

------------------------------------------------------------------
1. Summary:

Once the victim clicks on a specially crafted Facebook URL they can be
redirected to a malicious website.
------------------------------------------------------------------
2. Description:

Facebook applications use of 'track.php?r=' doesn't sanitize the redirection
input properly.  This allows an attacker to input any URL that a victim will
get redirected too.  It is not required for the victim to be login to
Facebook for this attack to work.

The following is an example of a vulnerable URL:
http://apps.facebook.com/truthsaboutu/track.php?r=http://www.securitypentest.com

The following Google search query can be used to find vulnerable URLs:
site:facebook.com inurl:"track.php?" inurl:"r="
------------------------------------------------------------------
3. Impact:

Potentially allow an attacker to compromise a victim’s Facebook account
and/or computer system.
------------------------------------------------------------------
4. Affected Products:

www.facebook.com
------------------------------------------------------------------
5. Solution:  None
------------------------------------------------------------------
6. Time Table:

2/27/2011 Reported Vulnerability to the Vendor
------------------------------------------------------------------
7. Credits:

Discovered by Nathan Power
www.securitypentest.com
------------------------------------------------------------------

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/