Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An XSS on Facebook via PNGs and Wonky Content Types

fin1te.net

Post reply on HN
Print view View original

31–40 of 48 posts

Re: An XSS on Facebook via PNGs and Wonky Content Types

#31

Post by caf »

grrowl wrote: post #25
nh2 wrote: post #22

Doesn't this XSS constitute a complete compromise of all Facebook user data, globally? (Assuming it had been found by a "bad guy", instead of a white-hat researcher.) Because: * He could execute arbitrary code in the browser of any user that views his picture * Including uploading all private photos and chats of that user to somewhere else * Or changing their password (assuming 2FA is not used) * He could have propag…

He couldn't have just "uploaded" images to a page, since facebook would output the original path (B1GL0N6H45H.png), where this relies on the .html extension. Easy enough to link people through Messenger or another site to that page, though. The core vector is the fact it's served off the photos.facebook.com domain.

A Facebook worm!

Re: An XSS on Facebook via PNGs and Wonky Content Types

#32

Post by [deleted] »

pyre wrote: post #16
ottertown wrote: post #2

Man, I work as a frontend engineer at one of the big tech companies and I understood like 25% of this post. And that's not meant to be a criticism, I'm just reflecting on my total ignorance of most security vulnerabilities. I know about and having implemented some measures against XSS / CSRF, but it's clear there are dozens of attack approaches I'm not even aware of. I feel like I have some homework to do.

The two major issues here: 1. Allowing something that is not HTML (and user-supplied) to be returned by the server with the text/html MIME type, causing the browser to want to parse it as HTML. 2. A link between the CDN (Akamai) domains and a top-level sub-domain on Facebook (i.e. photos.facebook.com was aliased to some Akamai domains). At this point the attacker is able to serve HTML from a Facebook domain. There ar…

[deleted]

Re: An XSS on Facebook via PNGs and Wonky Content Types

#33

Post by plugnburn »

Wow. Facebook had managed to fail on a thing absent in much less popular sites since the day one.

A CDN absolutely mustn't allow a user to browse to a file with a different extension than it was uploaded with. It must return 404 in this case. II think the flaw is much more severe than has been discovered.

Re: An XSS on Facebook via PNGs and Wonky Content Types

#35

Post by joev_ »

comex wrote: post #29

Hmm, I wonder if there is anything interesting you could do by creating a Service Worker for the CDN domain. It seems that the CDN will serve arbitrary files with a text/javascript Content-Type, which is the requirement to set one up. Once created, AFAIK, such a worker remains attached to the domain until an occasional attempt by the browser to refresh it fails, and it can intercept and modify any requests from webpa…

ServiceWorkers are scoped to the basename of the path they are served from, so you could only intercept a small subset of all possible CDN URLs. In the example, this would be resources under `/hads-ak-xat1/t45.1600-2/`. But you probably can't create a ServiceWorker here anyways as you need a route that returns valid Javascript of your choosing with a Content-Type `text/javascript`. Usually when I've seen an opportunity for ServiceWorker exploits it's due to a JSONP endpoint that does not sanitize its callback parameter.

If you could create a valid ServiceWorker at this route, and load it inside some same-domain HTML page, then you could theoretically use it to intercept and rewrite responses to any resources on the domain under its path. Depending on how you rewrite the response you might be able to get the browser to cache the rewritten resource, which could then get used by other domains. Theoretically. I have never tested this :)

Re: An XSS on Facebook via PNGs and Wonky Content Types

#36

Post by seanwilson »

nly wrote: post #13
speedy_go wrote: post #12

and they say CSP is useless...

I don't think CSP could have prevented this? Facebook.com is already CSP enabled, but CSP only prevents cross-origin injection of certain resource types (images, scripts, Javascript). This attack originated from Facebooks own domain and was served (well, sniffed) as HTML. Anyway, CSP clearly isn't useless... but try deploying it on your average Wordpress blog sometime.

> Anyway, CSP clearly isn't useless... but try deploying it on your average Wordpress blog sometime.

What issues have you found with this?

Re: An XSS on Facebook via PNGs and Wonky Content Types

#37

Post by sangnoir »

seanwilson wrote: post #36
nly wrote: post #13

Earlier quoted context omitted.

I don't think CSP could have prevented this? Facebook.com is already CSP enabled, but CSP only prevents cross-origin injection of certain resource types (images, scripts, Javascript). This attack originated from Facebooks own domain and was served (well, sniffed) as HTML. Anyway, CSP clearly isn't useless... but try deploying it on your average Wordpress blog sometime.

> Anyway, CSP clearly isn't useless... but try deploying it on your average Wordpress blog sometime. What issues have you found with this?

Not OP, but my guess is random plugins stop working with strict (i.e. secure) policies, if they weren't written with CSP in mind.

Re: An XSS on Facebook via PNGs and Wonky Content Types

#38

Post by yummybear »

ottertown wrote: post #2

Man, I work as a frontend engineer at one of the big tech companies and I understood like 25% of this post. And that's not meant to be a criticism, I'm just reflecting on my total ignorance of most security vulnerabilities. I know about and having implemented some measures against XSS / CSRF, but it's clear there are dozens of attack approaches I'm not even aware of. I feel like I have some homework to do.

Don't worry. Facebook's engineers missed this one too.

Re: An XSS on Facebook via PNGs and Wonky Content Types

#39

Post by seanwilson »

sangnoir wrote: post #37
seanwilson wrote: post #36

Earlier quoted context omitted.

> Anyway, CSP clearly isn't useless... but try deploying it on your average Wordpress blog sometime. What issues have you found with this?

Not OP, but my guess is random plugins stop working with strict (i.e. secure) policies, if they weren't written with CSP in mind.

Bad for development time but good for security then I'd guess.

Re: An XSS on Facebook via PNGs and Wonky Content Types

#40

Post by mettamage »

viraptor wrote: post #19
LeifCarrotson wrote: post #17

Earlier quoted context omitted.

> I mistake the complicatedness for complexity You conjugated the same word two ways. What do you mean?

I think he meant the difference between things being complicated (possibly unnecessarily) and complex (inherently). Simple things can be complicated to the level they're hard to understand, but it doesn't mean they are complex.

Yes this is what I meant. Perhaps I should've given a bit more context in my original post.

Here's a fun example. English has a lot of Latin and Germanic based words in it that you can construct entire sentences. I was surprised to find out as a non-native speaker. In my opinion, the Latin sentences seem way too complicated to express simple ideas.

Germanic example: In my anger I struck my small sword in his belly.

Latin example: In my rage I injected my gladius in his abdomen.

More examples: http://corrinejackson.com/wordpress/2013/04/23/tuesday-writi...

http://www.antimoon.com/forum/t2068.htm

Post reply on HN