Wait, so how do you escalate this to RCE?
If he can do remote network calls couldn't he download a file, like netcat?
How I found a Remote Code Execution bug affecting Facebook's servers
41–50 of 59 posts
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#42Wait, so how do you escalate this to RCE?
Don't think either party has disclosed that. >and due to a valid scenario he theorized involving an administrative feature we are scheduled to deprecate soon, we decided to re-classify the issue as a potential RCE bug. I imagine it might be some feature that could maybe be triggered internally through a file:// or http://localhost/ URL, and in doing so gain access to an interface that can issue shell commands. That's…
You're actually pretty close.
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#43Earlier quoted context omitted.
People here seem to have a strongly misplaced expectations about what bug bounties pay. Vulnerabilities in web apps/servers tend to be worth less than vulnerabilities in client computers for a few reasons First, web app vulns are usually specific to a single site. (Unless obviously you find an issue in a common underlining framework, say, a session fixation attack in how PHP or ASP.NET handles sessions). Second, and…
Completely agree. To add, IMO the most valuable application of this exploit would have been to deliver drive-by malware. There are some groups that pay $0.5-3 CPM to get their Javascript onto much less targeted web sites. The Yahoo malware would have cost nearly double that. Getting drive-by traffic is one of the most expensive pieces of the puzzle for malware groups. Last time I checked the forums, a thousand visito…
Exactly. Pivoting from the server immediately to the clients by serving malware against the visiting browsers/plugins. Even if large site detects what you are doing quickly and shuts you down, you've leveraged that into controlling thousands of desktop machines
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#44Wait, so how do you escalate this to RCE?
If he can do remote network calls couldn't he download a file, like netcat?
My initial understanding is that the XXE flaw allows the attacker to read local files, or make network requests via the remote host (essentially, proxying them), but still only delivered to his client, rather than actually modifying or creating files on the remote host itself.
remote read access is much more limited than remote write access, but even write access will be limited by file permissions, and doesn't necessarily translate to code execution.
injecting some code into some of the web-app source that gets triggered by an additional request would probably be hte easiest way, but you might also look for system binaries that get called by cron or similar.
Sounds like he didn't use any of these, and it was actually some sort of local web-accessible (but externally firewalled) admin interface that a suitable request could exploit, and I'm very curious how that part of it would work (especially how you'd know/find out about it as an outsider)
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#45So, why is it possible to have XML files reading arbitrary stuff from whatever place again? XML is data . If your application needs to send a request for reading a file through XML this should really be explicit, not relying in a "permission happy" XML library, no?
Yes, XML is data, but it allows you to specify where other data is located that should be included when processing it. These links can be to addition data, or to definitions of how to process the data in the document (XML entities). It's a simplification, but it's as if XML can have #includes, where the source of the #include is a URL, and can even be a file:/// URL.
So the attack looks like this: Server takes input from evil user, inserts it into an XML document in memory. The input is malicious, and contains not only XML data, but XML directives to include other documents, specifically /etc/passwd on the location machine. The XML document is processed, the contents of /etc/passwd are automatically read by the XML parser/processor. However the data is not in the correct format, and the XML parser/processor spits out a detailed error message, showing the data that could not be processed/parsed, which is the contents of /etc/passwd.
Make sense?
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#46For those using the Java stack we have found HP's Fortify static analysis tool helpful in automatically detecting XXE vulnerabilities. http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Q2-20...
HP's WebInspect, a blackbox testing tool, also can find XXE's. However, as the OP shows, XXE's can be tricky and involve a lot of nuance to cox them out. General dynamic testing tools aren't as good at uncovering XXE's as static analysis tools.
Disclaimer: I used to work on WebInspect's audit engines
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#47Earlier quoted context omitted.
Fantastic bug, and great writeup. Of course, everyone will be curious about the payout ;)
Well, it's already disclosed, but I really wanted to know how much people would think this kind of bug is worth.
Comments on the FB post suggest the amount was 33,500$.
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#48Earlier quoted context omitted.
Not bad for 2 days of work.
The part of the work you don't see is the hours, days and months spent, usually unpaid, spent auditing code to find the bugs. It is like the anecdote of Tesla and Ford and knowing where to put the X[0], you aren't paying for time or manual labour - bug value is derived from how much damage it can cause, what its worth to Facebook to not be exploited and what the exploit is worth to the bad guys on the black market. […
He says that it took him about 2 days total
Re: How I found a Remote Code Execution bug affecting Facebook's servers
#49Re: How I found a Remote Code Execution bug affecting Facebook's servers
#50The payment was apparently USD 33'500. Not being in the bug bounty business, I had expected a higher payment.
$33,500?