============================================= INTERNET SECURITY AUDITORS ALERT 2010-001 - Original release date: January 8th, 2010 - Last revised: February 3rd, 2010 - Discovered by: Juan Galiana Lara - Severity: 6.3/10 (CVSS Base Score) ============================================= I. VULNERABILITY ------------------------- Facebook HTML and Script code injection vulnerability II. BACKGROUND ------------------------- Facebook is a social networking website that is operated and privately owned by Facebook, Inc. Users can add friends and send them messages, and update their personal profiles to notify friends about themselves. Additionally, users can join networks organized by city, workplace, school, and region. The website's name stems from the colloquial name of books given at the start of the academic year by university administrations with the intention of helping students to get to know each other better. III. DESCRIPTION ------------------------- The mobile interface of Facebook social network is affected by Cross-Site Scripting vulnerability due variable "q" is not properly sanitized in http://m.facebook.com/friends.php. An attacker can inject HTML or script code in the context of victim's browser, so can perform XSS attacks, and steal cookies of a targeted user. IV. PROOF OF CONCEPT ------------------------- http://m.facebook.com/friends.php?q=%3Cscript%3Ealert(%22XSS%22)%3B%3C%2Fscript%3E V. BUSINESS IMPACT ------------------------- An attacker can execute arbitrary HTML or script code in a targeted user's browser, this can leverage to steal user targeted cookies. VI. SYSTEMS AFFECTED ------------------------- Facebook VII. SOLUTION ------------------------- Corrected VIII. REFERENCES ------------------------- http://www.facebook.com http://www.isecauditors.com http://juangaliana.blogspot.com IX. CREDITS ------------------------- This vulnerability has been discovered by Juan Galiana Lara (jgaliana (at) isecauditors (dot) com). X. REVISION HISTORY ------------------------- January 8, 2010: Initial release. February 3, 2010: Last revision. XI. DISCLOSURE TIMELINE ------------------------- January 2, 2010: Discovered by Internet Security Auditors. January 9, 2010: Vendor contacted including PoC. No response. January 11, 2010: Second contact. No response. January 19, 2010: Third contact. No response. January 20, 2010: Vulnerability corrected without any kind of contact. January 31, 2010: Response from Facebook Security member requiring info. February 3, 2010: Sent to lists for public interest. XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.