Facebook URL Redirect Vulnerability

[Nathan Power <np () securitypentest com>]

------------------------------------------------------------------
1. Summary:

Once the victim clicks on a specially crafted Facebook URL they can be
redirected to a malicious website.
------------------------------------------------------------------
2. Description:

Facebook applications use of 'track.php?r=' doesn't sanitize the redirection
input properly.  This allows an attacker to input any URL that a victim will
get redirected too.  It is not required for the victim to be login to
Facebook for this attack to work.

The following is an example of a vulnerable URL:
http://apps.facebook.com/truthsaboutu/track.php?r=http://www.securitypentest.com

The following Google search query can be used to find vulnerable URLs:
site:facebook.com inurl:"track.php?" inurl:"r="
------------------------------------------------------------------
3. Impact:

Potentially allow an attacker to compromise a victim’s Facebook account
and/or computer system.
------------------------------------------------------------------
4. Affected Products:

www.facebook.com
------------------------------------------------------------------
5. Solution:  None
------------------------------------------------------------------
6. Time Table:

2/27/2011 Reported Vulnerability to the Vendor
------------------------------------------------------------------
7. Credits:

Discovered by Nathan Power
www.securitypentest.com
------------------------------------------------------------------

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/