The fact that the machine has a hostname "*.thefacebook.com" doesn't imply that it also runs software of the "Facebook" social media software. So not sure how much impact this exploit would have had.
Remote Code Execution on a Facebook server
81–90 of 207 posts
Re: Remote Code Execution on a Facebook server
#82The fact that the machine has a hostname "*.thefacebook.com" doesn't imply that it also runs software of the "Facebook" social media software. So not sure how much impact this exploit would have had.
I don't think anyone will ever know how much impact, but it implies that Facebook is not good at security.
Re: Remote Code Execution on a Facebook server
#83This is why you (looking at frameworks) should never use a format that may contain code to store data, especially when the client has control over that data (even if signed). The same vulnerability has occurred in almost every language/framework that does this, including Rails and Java-based ones. Just use something like JSON, which completely avoids code execution vulnerabilities like this. Except of course for the early JavaScript JSON parsers that just used eval for parsing...
Re: Remote Code Execution on a Facebook server
#84The fact that the machine has a hostname "*.thefacebook.com" doesn't imply that it also runs software of the "Facebook" social media software. So not sure how much impact this exploit would have had.
I don't think anyone will ever know how much impact, but it implies that Facebook is not good at security.
I have bad news for you. No one is good at security.
Re: Remote Code Execution on a Facebook server
#85> scanning an IP range that belongs to Facebook (199.201.65.0/24) ping -4 facebook.com results in 157.240.18.35. Maybe, author used some other way to get those IPs. Can anyone throw a light on this?
Re: Remote Code Execution on a Facebook server
#86Wow, a fix in <24 hours, that's pretty impressive.
It took them more than 10 days actually... They just shutdown the instance until they could find a solution.
30.07.2018 00:00 CEST : initial disclosure with every details.
09.08.2018 18:10 CEST : patch in place.
Re: Remote Code Execution on a Facebook server
#87Some surprising takeaways for me;
Facebook uses a Django app in their infrastructure.
That app was in debug mode, revealing server secrets.
That app was also configured to use the Pickle based session storage, leading to one of the few serious RCE vulnerabilities in Django.
I'll have to remember this next time I think an exploit scenario is too unlikely.
Re: Remote Code Execution on a Facebook server
#88> I found a Sentry service hosted on 199.201.65.36 I do not remember on top of my head now but I think there are few scanning software to find all the running apps on a remote machine. If you are aware then please share
Re: Remote Code Execution on a Facebook server
#89Re: Remote Code Execution on a Facebook server
#90He got $5k for an arbitrary remote execution bug? What a rip-off.
I agree he deserves a higher payout, but it was on a segmented server that seems like it didn't have any customer data or other important data. If he were a real attacker, who knows where else he could've pivoted from this server (perhaps it wasn't quite as segmented as Facebook thought). But assuming it truly was pretty isolated, compromising it probably wouldn't have caused any damage.
Regardless, I feel like he deserves at least $15,000 for this, since it is full RCE.