full-disclosure - Facebook Url Redirection Vuln.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 11 Jul 2013 14:18:16 +0300
From: CANSIN YILDIRIM <canyildirim@...edu.tr>
To: illsecresearchgroup@...il.com, full-disclosure@...ts.grok.org.uk, 
 bugtraq@...urityfocus.com
Subject: Facebook Url Redirection Vuln.

------------------------------------------------------------------------
#Title: Facebook Url Redirection Vulnerability
#Discovery Date: 10/July/2013
#Author: Cansın Yıldırım
#Twitter: @YildirimCansin
#Website: www.cansinyildirim.com
------------------------------------------------------------------------

Introduction:

The vulnerability reported on 10th July however Facebook Security Team
replied that it is an expected behavior. That is why I don't see any reason
not to publish the vulnerability. More detailed background information can
be found on their website:
http://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766

Description:

By obtaining user-specific hash value, an attacker redirect the user to a
malicious website without asking for verification. The hash value can be
found from the link that the user send to his/her wall. After clicking on
user's link,by setting BurpSuite Proxy, the attacker intercept the
parameters in the methods.

Example url:
http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DSvWjWEyTLkg&h=3AQGbk0Cf&s=1

However we don't need s parameter, for the attacker most important part of
the url is the h parameter.

Example h parameter = h=3AQGbk0Cf

Now it is time to change the u parameter to a malicious site and send it to
user with the same h parameter

Example malicious url:
http://www.facebook.com/l.php?u=cansinyildirim.com&h=3AQGbk0Cf

Example malicious encoded url:
http://www.facebook.com/l.php?u=%63%61%6e%73%69%6e%79%69%6c%64%69%72%69%6d%2e%63%6f%6d&h=3AQGbk0Cf

After the victim clicks on the link, Facebook redirects the victim to a
page specified by the attacker.

Important note: I tried while the attacker and the victim are friends.

Proof of Concept:

http://vimeo.com/70087250

http://www.cansinyildirim.com/facebook-url-redirection-vulnerability-2013/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/