Facebook social network vulnerable to CSRF
CSRF in the "Change password" function of the Facebook social network.
Antecedentes
Facebook is a social networking service (www.facebook.com) launched in February 2004 and operated by Facebook, Inc. In July 2011, it had more than 750 million active users.
Description
Cross-Site Request Forgery (CSRF, also known as a one-click attack or session riding) transmits unauthorized commands from a user in whom the site trusts. Facebook is vulnerable to CSRF in the "Change password" feature: the only element that authenticates the user is the session cookie, which the browser automatically sends with every request and which is not associated with other typical parameters (such as the IP address), so the authenticated request can be made from different physical locations. An attacker can create a page with multiple requests (password guessing attack) to that feature and change the passwords of the authenticated users who visit it.
Business impact
Selective denial of service to Facebook users (changing their password) and possible access to other users' accounts.
Affected systems
The Facebook social network: www.facebook.com (main site), m.facebook.com and touch.facebook.com (mobile versions).
Solución
The manufacturer has not provided any solution.
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-independent provider with in-depth experience since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)