Facebook Url Redirection Vuln.

From: CANSIN YILDIRIM <canyildirim@ku.edu.tr>
To: bugtraq@securityfocus.com
Subject: Facebook Url Redirection Vuln.

#Title: Facebook Url Redirection Vulnerability
#Discovery Date: 10/July/2013
#Author: Cansın Yıldırım
#Twitter: @YildirimCansin
#Website: www.cansinyildirim.com


The vulnerability reported on 10th July however Facebook Security Team
replied that it is an expected behaviour. That is why I don't see any
reason not to publish the vulnerability. More detailed background
information can be found on their website:


By obtaining user-specific hash value, an attacker redirect the user
to a malicious website without asking for verification. The hash value
can be found from the link that the user send to his/her wall. After
clicking on user's link,by setting BurpSuite Proxy, the attacker
intercept the parameters in the methods.

Example url: http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DSvWjWEyTLkg&h=3AQGbk0Cf&s=1

However we don't need s parameter, for the attacker most important
part of the url is the h paramater.

Example h paramater = h=3AQGbk0Cf

Now it is time to change the u paramater to a malicious site and send
it to user with the same h paramater

Example malicious url:

Example malicious encoded url:

After the victim clicks on the link, Facebook redirects the victim to
a page specified by the attacker.

Important note: I tried while the attacker and the victim were friends.

Proof of Concept:



Copyright © 1995-2020 LinuxRocket.net. All rights reserved.