Bugtraq mailing list archives
Re: Facebook Url Redirection Vuln.
From: Anthony Dubuissez <anthony.dubuissez () webera fr>
Date: Thu, 11 Jul 2013 16:35:21 +0200
Isn't it a MitM situation ? if you can intercept that value you can intercept more than a simple parameter no ? Le 11 juil. 2013 à 13:32, CANSIN YILDIRIM <canyildirim () ku edu tr> a écrit :
----------------------------------------------------- #Title: Facebook Url Redirection Vulnerability #Discovery Date: 10/July/2013 #Author: Cansın Yıldırım #Twitter: @YildirimCansin #Website: www.cansinyildirim.com ----------------------------------------------------- Introduction: The vulnerability reported on 10th July however Facebook Security Team replied that it is an expected behaviour. That is why I don't see any reason not to publish the vulnerability. More detailed background information can be found on their website: http://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766 Decription: By obtaining user-specific hash value, an attacker redirect the user to a malicious website without asking for verification. The hash value can be found from the link that the user send to his/her wall. After clicking on user's link,by setting BurpSuite Proxy, the attacker intercept the parameters in the methods. Example url: http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DSvWjWEyTLkg&h=3AQGbk0Cf&s=1 However we don't need s parameter, for the attacker most important part of the url is the h paramater. Example h paramater = h=3AQGbk0Cf Now it is time to change the u paramater to a malicious site and send it to user with the same h paramater Example malicious url: http://www.facebook.com/l.php?u=cansinyildirim.com&h=3AQGbk0Cf Example malicious encoded url: http://www.facebook.com/l.php?u=%63%61%6e%73%69%6e%79%69%6c%64%69%72%69%6d%2e%63%6f%6d&h=3AQGbk0Cf After the victim clicks on the link, Facebook redirects the victim to a page specified by the attacker. Important note: I tried while the attacker and the victim were friends. Proof of Concept: http://vimeo.com/70087250 http://www.cansinyildirim.com/facebook-url-redirection-vulnerability-2013/
Current thread:
- Facebook Url Redirection Vuln. CANSIN YILDIRIM (Jul 11)
- Re: Facebook Url Redirection Vuln. Anthony Dubuissez (Jul 11)
- Re: Facebook Url Redirection Vuln. Jann Horn (Jul 11)
- Re: Facebook Url Redirection Vuln. Anthony Dubuissez (Jul 11)