1. Summary: Once the victim clicks on a specially crafted Facebook URL they can be redirected to a malicious website.

2. Description: Facebook applications use of 'track.php?r=' doesn't sanitize the redirection input properly. This allows an attacker to input any URL that a victim will get redirected too. It is not required for the victim to be login to Facebook for this attack to work.

The following is an example of a vulnerable URL:

The following Google query can be used to find vulnerable URLs:
site:facebook.com inurl:"track.php?" inurl:"r="

3. Impact: Potentially allow an attacker to compromise a victim’s Facebook account and/or computer system.

4. Affected Products: www.facebook.com

5. Solution: None


0 comentarios: