10

There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a similar attack?

Improve this question

2 Answers 2

Reset to default
9

Here is a good overall reference http://cwe.mitre.org/data/definitions/79.html

per www.infosecisland.com:

From Symantec's Candid Wueest:

"The vulnerability exists in the mobile API version of Facebook due to insufficient JavaScript filtering. It allows any website to include, for example, a maliciously prepared iframe element that contains JavaScript or use the http-equiv attribute’s “refresh” value to redirect the browser to the prepared URL containing the JavaScript."

"Any user who is logged into Facebook and visits a site that contains such an element will automatically post an arbitrary message to his or her wall. There is no other user interaction required, and there are no tricks involved, like clickjacking."

"Just visiting an infected website is enough to post a message that the attacker has chosen. Therefore it should be of no surprise that some of those messages are spreading very fast through Facebook. Some are posting links to infected websites, creating XSS worms that spread from user to user."

Facebook has patched the JavaScript-based XSS vulnerability, and the company says they are now working to undo the damage done by the attack.

So the issue is related to neutralizing data input into web pages.

Improve this answer
4

Of course, we now live in the internet era, so, there's a video for that!

https://www.youtube.com/watch?v=QcSAU16wjHQ

It is almost 10 minutes long, complete with all the details you would like, reviewing the exploit code and its functionality.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .