BugTraq
Facebook Url Redirection Vuln. Jul 11 2013 11:32AM
CANSIN YILDIRIM (canyildirim ku edu tr) (1 replies)
Re: Facebook Url Redirection Vuln. Jul 11 2013 02:35PM
Anthony Dubuissez (anthony dubuissez webera fr) (1 replies)
Isn't it a MitM situation ? if you can intercept that value you can intercept more than a simple parameter no ?

Le 11 juil. 2013 à 13:32, CANSIN YILDIRIM <canyildirim (at) ku.edu (dot) tr [email concealed]> a écrit :

> -----------------------------------------------------
> #Title: Facebook Url Redirection Vulnerability
> #Discovery Date: 10/July/2013
> #Author: Cansın Yıldırım
> #Twitter: @YildirimCansin
> #Website: www.cansinyildirim.com
> -----------------------------------------------------
>
> Introduction:
>
> The vulnerability reported on 10th July however Facebook Security Team
> replied that it is an expected behaviour. That is why I don't see any
> reason not to publish the vulnerability. More detailed background
> information can be found on their website:
> http://www.facebook.com/notes/facebook-security/link-shim-protecting-the
-people-who-use-facebook-from-malicious-urls/10150492832835766
>
> Decription:
>
> By obtaining user-specific hash value, an attacker redirect the user
> to a malicious website without asking for verification. The hash value
> can be found from the link that the user send to his/her wall. After
> clicking on user's link,by setting BurpSuite Proxy, the attacker
> intercept the parameters in the methods.
>
> Example url: http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv
%3DSvWjWEyTLkg&h=3AQGbk0Cf&s=1
>
> However we don't need s parameter, for the attacker most important
> part of the url is the h paramater.
>
> Example h paramater = h=3AQGbk0Cf
>
> Now it is time to change the u paramater to a malicious site and send
> it to user with the same h paramater
>
> Example malicious url:
> http://www.facebook.com/l.php?u=cansinyildirim.com&h=3AQGbk0Cf
>
> Example malicious encoded url:
> http://www.facebook.com/l.php?u=%63%61%6e%73%69%6e%79%69%6c%64%69%72%69%
6d%2e%63%6f%6d&h=3AQGbk0Cf
>
> After the victim clicks on the link, Facebook redirects the victim to
> a page specified by the attacker.
>
> Important note: I tried while the attacker and the victim were friends.
>
>
> Proof of Concept:
>
> http://vimeo.com/70087250
>
> http://www.cansinyildirim.com/facebook-url-redirection-vulnerability-201
3/

[ reply ]
Re: Facebook Url Redirection Vuln. Jul 11 2013 04:04PM
Jann Horn jann+libev (at) thejh (dot) net [email concealed] (jann+libev thejh net)


 

Privacy Statement
Copyright 2010, SecurityFocus