Would you believe it if we told you that clicking on a single malicious link could hack your Facebook account? The scenario is entirely possible due to a recently uncovered critical cross-site request forgery (CSRF) vulnerability. The Facebook CSRF flaw could allow attackers to hijack accounts by merely luring targeted users into clicking on the specially crafted URL.
Facebook CSRF Vulnerability Explained
The vulnerability was discovered by a researcher known online as Samm0uda. Apparently, he noticed a flawed endpoint that could have been compromised to bypass CSRF protections leading to account takeovers.
According to the researcher’s report and demonstration:
The vulnerable endpoint is https://www.facebook.com/comet/dialog_DONOTUSE/?url=XXXX where XXXX is the endpoint with parameters where the POST request is going to be made (the CSRF token fb_dtsg is added automatically to the request body).
This allowed him to make many actions, in case the victim visited a maliciously crafted URL for the purpose.
For the account takeover to successfully take place, a new email address or phone number has to be added to the victim’s account.
The issue here is that the victim has to visit two separate URLs – one to add the email/phone number, and one to confirm it because the “normal” endpoints used to add emails or phone numbers don’t have a “next” parameter to redirect the user after a successful request, the researcher wrote.
To bypass this obstacle, the researcher had to find endpoints where the “next” parameter was present so that the account takeover happens with a single URL.
It should be noted that once access to the user’s authentication tokens is obtained, an attacker-controlled email address is added to the account. This further enables attackers to take over accounts by simply resetting passwords and locking the user out of his/her account.
All in all, the Facebook CSRF vulnerability presented by the researcher presents a complete one-click exploit that enables attacker to easily hijack accounts. However, this can be avoided with the help of two-factor authentication added to the Facebook account. 2FA would prevent a threat actor from logging into victims’ accounts, unless attackers are able to verify the 6-digit passcode which is sent to the user’s mobile device.
It should be noted that attackers may still be able to exploit the vulnerability and perform various malicious actions such as changing the user’s profile picture or posting on their timeline.
The vulnerability has been reported to Facebook on January 26, and was addressed on January 31. The Samm0uda researcher got $25,000 as a reward via Facebook’s bug bounty program.
Facebook has squandered approximately $4.3 million on more than 2,400 bug reports, sent by 800 researchers in the years 2011-2016. Most of the vulnerabilities reported through the program in this program were XSS (cross-site scripting) bugs, CSRF bugs (such as the one described in the article), and Business logic flaws.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: