Excellent writeup and congratulations to Jack (fin1te)! He's been a long time bug bounty hunter for Facebook and he's joining their Product Security team in three weeks.
An XSS on Facebook via PNGs and Wonky Content Types
11–20 of 48 posts
Re: An XSS on Facebook via PNGs and Wonky Content Types
#12and they say CSP is useless...
Re: An XSS on Facebook via PNGs and Wonky Content Types
#13and they say CSP is useless...
I don't think CSP could have prevented this? Facebook.com is already CSP enabled, but CSP only prevents cross-origin injection of certain resource types (images, scripts, Javascript). This attack originated from Facebooks own domain and was served (well, sniffed) as HTML.
Anyway, CSP clearly isn't useless... but try deploying it on your average Wordpress blog sometime.
Re: An XSS on Facebook via PNGs and Wonky Content Types
#14and they say CSP is useless...
I don't think CSP could have prevented this? Facebook.com is already CSP enabled, but CSP only prevents cross-origin injection of certain resource types (images, scripts, Javascript). This attack originated from Facebooks own domain and was served (well, sniffed) as HTML. Anyway, CSP clearly isn't useless... but try deploying it on your average Wordpress blog sometime.
> CSP only prevents cross-origin injection of certain resource types (images, scripts, Javascript).
Are you sure ONLY? Enable CSP on a XSS-vulnerable website, send a payload, CSP prevents XSS from executing if your policy say so.
Re: An XSS on Facebook via PNGs and Wonky Content Types
#15That is incredibly clever, particularly exploiting DEFLATE to generate text. I would've never thought of that.
Re: An XSS on Facebook via PNGs and Wonky Content Types
#16Man, I work as a frontend engineer at one of the big tech companies and I understood like 25% of this post. And that's not meant to be a criticism, I'm just reflecting on my total ignorance of most security vulnerabilities. I know about and having implemented some measures against XSS / CSRF, but it's clear there are dozens of attack approaches I'm not even aware of. I feel like I have some homework to do.
The two major issues here:
1. Allowing something that is not HTML (and user-supplied) to be returned by the server with the text/html MIME type, causing the browser to want to parse it as HTML.
2. A link between the CDN (Akamai) domains and a top-level sub-domain on Facebook (i.e. photos.facebook.com was aliased to some Akamai domains).
At this point the attacker is able to serve HTML from a Facebook domain. There are things that could be protected against here, but the attacker has a lot of vectors they can go for at this point.
Re: An XSS on Facebook via PNGs and Wonky Content Types
#17Man, I work as a frontend engineer at one of the big tech companies and I understood like 25% of this post. And that's not meant to be a criticism, I'm just reflecting on my total ignorance of most security vulnerabilities. I know about and having implemented some measures against XSS / CSRF, but it's clear there are dozens of attack approaches I'm not even aware of. I feel like I have some homework to do.
Well, he's a security specialist. And I feel he's figuring out new ways to attack. If you're not an attacker yourself, then I think you'll always lag behind. I'm currently taking a security class and what I'm noticing is that I mistake the complicatedness for complexity but in essence most vulnerabilities and attacks have the same high level overview. What I'm trying to say is: don't feel so bad, if you understood 25…
> I mistake the complicatedness for complexity
You conjugated the same word two ways. What do you mean?
Re: An XSS on Facebook via PNGs and Wonky Content Types
#18That is incredibly clever, particularly exploiting DEFLATE to generate text. I would've never thought of that.
They didn't use DEFLATE to generate the text. They used a known text and prepended garbage to it until it DEFLATEd correctly (to any result). Small difference, but still.
Re: An XSS on Facebook via PNGs and Wonky Content Types
#19Earlier quoted context omitted.
Well, he's a security specialist. And I feel he's figuring out new ways to attack. If you're not an attacker yourself, then I think you'll always lag behind. I'm currently taking a security class and what I'm noticing is that I mistake the complicatedness for complexity but in essence most vulnerabilities and attacks have the same high level overview. What I'm trying to say is: don't feel so bad, if you understood 25…
> I mistake the complicatedness for complexity You conjugated the same word two ways. What do you mean?
I think he meant the difference between things being complicated (possibly unnecessarily) and complex (inherently). Simple things can be complicated to the level they're hard to understand, but it doesn't mean they are complex.
Re: An XSS on Facebook via PNGs and Wonky Content Types
#20Earlier quoted context omitted.
Well, he's a security specialist. And I feel he's figuring out new ways to attack. If you're not an attacker yourself, then I think you'll always lag behind. I'm currently taking a security class and what I'm noticing is that I mistake the complicatedness for complexity but in essence most vulnerabilities and attacks have the same high level overview. What I'm trying to say is: don't feel so bad, if you understood 25…
> I mistake the complicatedness for complexity You conjugated the same word two ways. What do you mean?
Complexity is an adjective turned into a noun.
Complex -> complexity
On the other hand, complicatedness is a verb turned into an adjective turned into a noun.
Complicate -> complicated -> complicatedness
I read that as an implication that security concepts are not inherently difficult but are made difficult by people who explain it incorrectly.