Document Title: =============== Facebook BugBounty #2 - Persistent Web Vulnerabilities References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=239 http://www.vulnerability-lab.com/get_content.php?id=277 Release Date: ============= 2011-09-19 Vulnerability Laboratory ID (VL-ID): ==================================== 239 Product & Service Introduction: =============================== Facebook is a social networking service and website launched in February 2004, operated and privately owned by Facebook, Inc. As of July 2011, Facebook has more than 750 million active users. Users may create a personal profile, add other users as friends, and exchange messages, including automatic notifications when they update their profile. Facebook users must register before using the site. Additionally, users may join common-interest user groups, organized by workplace, school or college, or other characteristics. (Copy of the Vendor Website: http://en.wikipedia.org/wiki/Facebook) Abstract Advisory Information: ============================== Vulnerability Lab Team discovered multiple persistent web vulnerabilities in a main module of the facebook website. Vulnerability Disclosure Timeline: ================================== 2011-08-01: Vendor Notification 2011-08-04: Vendor Response/Feedback 2011-09-10: Vendor Fix/Patch 2011-09-16: Public or Non-Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ Multiple persistent input validation vulnerabilities are detected on the Facebook vendor website. The vulnerability allows an remote attacker to implement malicious persistent script codes in a preview listing module of facebook. The successful exploitation of the vulnerability can lead to session hijacking, events module content manipulation, implementation of persistent malware links & redirection to external malicious websites without authorization. The bug is located in a preview listing module in the description of a location. Vulnerable Module(s): [+] Events - Change Listing Preview Affected Input(s): [+] Where? & What are you plaining? What are you plaining? Pictures: ../1.png Proof of Concept (PoC): ======================= The vulnerability can be exploited by remote attackers. For demonstration or reproduce ... PoC: ">