Re: Facebook vuln.

[Atul Agarwal <atul () secfence com>]

Well, this has been there for quite a long time.

Another variation (which can control the title content too, making it more
believable) :

https://www.facebook.com/connect/connect_to_node_error.php?title=Really%3F&body=Hello%20World
!

But yes, AFAIK, html tags cannot be injected. Although, a self-xss attack
could be done.

https://www.facebook.com/connect/connect_to_node_error.php?title=Official%20Facebook%20Script&body=Copy%20and%20paste%20the%20following%20script%20in%20the%20address%20bar%20:%20javascript:alert(document.cookie)
;

That's the max you could do with it (I think!)

Thanks,
Atul Agarwal
Secfence Technologies
http://www.secfence.com



On Mon, May 23, 2011 at 12:16 AM, ichib0d crane <themadichib0d () gmail com>wrote:

>  Turns out....not so much :P
>
>
> https://www.facebook.com/connect/connect_to_node_error.php?body=%3Cscript%3Ealert%28String.fromCharCode%2888,%2083,%2083%29%29%3C/script%3E
>
>  Sure maybe there is a way to bypass the filter but good luck.
>
>  Probably be a good idea to include a better PoC next time.
>
> > On Sun, May 22, 2011 at 11:28 AM, Gustavo <gustavorobertux () gmail com>
> wrote:
> >
> https://www.facebook.com/connect/connect_to_node_error.php?body=VULNERABLE
> > :(
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/