Facebook CSRF Bug Leads to Account Takeovers with a Single Click

Facebook CSRF Bug Leads to Account Takeovers with a Single Click

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

Would you believe it if we told you that clicking on a single malicious link could hack your Facebook account? The scenario is entirely possible due to a recently uncovered critical cross-site request forgery (CSRF) vulnerability. The flaw could allow attackers to hijack accounts by merely luring targeted users into clicking on the specially crafted URL.

New CSRF Vulnerability in Facebook

The vulnerability was discovered by a researcher known online as Samm0uda. Apparently, he noticed a flawed endpoint that could have been compromised to bypass CSRF protections leading to account takeovers.

According to the researcher’s report and demonstration:

The vulnerable endpoint is https://www.facebook.com/comet/dialog_DONOTUSE/?url=XXXX where XXXX is the endpoint with parameters where the POST request is going to be made (the CSRF token fb_dtsg is added automatically to the request body).

This allowed him to make many actions, in case the victim visited a maliciously crafted URL for the purpose.
For the account takeover to successfully take place, a new email address or phone number has to be added to the victim’s account.

The issue here is that the victim has to visit two separate URLs – one to add the email/phone number, and one to confirm it because the “normal” endpoints used to add emails or phone numbers don’t have a “next” parameter to redirect the user after a successful request, the researcher wrote.

Facebook has notified 800,000 users about a ?blocked? bug. Blocked individuals on Facebook and Messenger of the affected users were temporarily unblocked.
Facebook Bug Unblocked Your Blocked Friends for a Week

To bypass this obstacle, the researcher had to find endpoints where the “next” parameter was present so that the account takeover happens with a single URL.

It should be noted that once access to the user’s authentication tokens is obtained, an attacker-controlled email address is added to the account. This further enables attackers to take over accounts by simply resetting passwords and locking the user out of his/her account.

All in all, the vulnerability presented by the researcher presents a complete one-click exploit that enables attacker to easily hijack accounts. However, this can be avoided with the help of two-factor authentication added to the Facebook account. 2FA would prevent a threat actor from logging into victims’ accounts, unless attackers are able to verify the 6-digit passcode which is sent to the user’s mobile device.

Andrew Leonov has been awarded $40,000 for breaching the social network and fixing a previously known remote code execution vulnerability.
Previously Patched Facebook Remote Code Execution Bug Deemed Exploitable

It should be noted that attackers may still be able to exploit the vulnerability and perform various malicious actions such as changing the user’s profile picture or posting on their timeline.

The vulnerability has been reported to Facebook on January 26, and was addressed on January 31. The Samm0uda researcher got $25,000 as a reward via Facebook’s bug bounty program.

Facebook has squandered

Most multinational companies have bug bounty programs that encourage independent researchers to locate and report vulnerabilities. Facebook doesn?t make an exception. As a matter of fact, the popular social network has spent lots of money on flaw reports since its...Read more
approximately $4.3 million on more than 2,400 bug reports, sent by 800 researchers in the years 2011-2016. Most of the vulnerabilities reported through the program in this program were XSS (cross-site scripting) bugs, CSRF bugs (such as the one described in the article), and Business logic flaws.


Milena Dimitrova

An inspired writer and content manager who has been with SensorsTechForum for 4 years. Enjoys ‘Mr. Robot’ and fears ‘1984’. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles!

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share