February 27, 2011

Facebook URL Redirect Vulnerability












1. Summary:

Once the victim clicks on a specially crafted Facebook URL they can be redirected to a malicious website.



2. Description:

Facebook applications use of 'track.php?r=' doesn't sanitize the redirection input properly.  This allows an attacker to input any URL that a victim will get redirected too.  It is not required for the victim to be login to Facebook for this attack to work.

The following is an example of a vulnerable URL:
http://apps.facebook.com/truthsaboutu/track.php?r=http://www.securitypentest.com

The following Google query can be used to find vulnerable URLs:
site:facebook.com inurl:"track.php?" inurl:"r="


3. Impact:

Potentially allow an attacker to compromise a victim’s Facebook account and/or computer system.


4. Affected Products:

www.facebook.com


5. Solution:

2/27/2011 None
4/25/2011 Only works when your login to Facebook
6/25/2011 Fixed


6. Time Table:

2/27/2011 Reported Vulnerability to the Vendor
2/28/2011 Vendor Acknowledge Vulnerability
6/25/2011 Verified the Vulnerability is Fixed


7. Credits:

Discovered by Nathan Power
www.securitypentest.com