Document Title: =============== Facebook (Law Enforcement) - Filter Bypass Vulnerability Date: ===== 2016-10-02 References: =========== http://www.vulnerability-lab.com/get_content.php?id=1774 VL-ID: ===== 1774 Common Vulnerability Scoring System: ==================================== 3.9 Vulnerability Class: ==================== Filter or Protection Mechanism Bypass Introduction: ============= Facebook is a corporation and online social networking service headquartered in Menlo Park, California, in the United States. Its website was launched on February 4, 2004, by Mark Zuckerberg with his Harvard College roommates and fellow students Eduardo Saverin, Andrew McCollum, Dustin Moskovitz and Chris Hughes. The founders had initially limited the websites membership to Harvard students, but later expanded it to colleges in the Boston area, the Ivy League, and Stanford University. It gradually added support for students at various other universities and later to high-school students. Since 2006, anyone who is at least 13 years old was allowed to become a registered user of the website, though the age requirement may be higher depending on applicable local laws. Its name comes from the face book directories often given to American university students. (Copy of the Homepage: https://en.wikipedia.org/wiki/Facebook ) These operational guidelines are for law enforcement officials seeking records from Facebook. For private party requests, including requests from civil litigants and criminal defendants, visit: facebook.com/help/?page=1057. Users seeking information on their own accounts can access Facebook’s “Download Your Information” feature from their account settings. See facebook.com/help/?page=18830. This information may change at any time. (Copy of the Homepage: https://www.facebook.com/safety/groups/law/guidelines/ ) Abstract: ========= The Vulnerability Laboratory Core Research Team discovered a filter bypass vulnerability in the official Facebook (Law Enforcement) web-application. Report-Timeline: ================ 2016-10-02: Public Disclosure (Vulnerability Laboratory) Status: ======== Published Affected Products: ================== Exploitation-Technique: ======================= Remote Severity: ========= Medium Details: ======== A filter bypass web vulnerability has been discovered in the official Facebook Law Enforcement online service web-application. The vulnerability allows remote attackers to bypass the secure filter and protection mechanism of an input to the application dbms. The basic email filter validation of the law enforcement registration disallow special chars like script codes and other invalid characters. The validation procedure approval of the input approves whether there is a valid email or an invalid input. By approving the filter validation of the registration email procedure we was able to figure out how to bypass the basic filter validation to inject invalid or malicious context to the dbms. The filter validation disallows for example >,<(script),,(no@domain) and &. As far as an account inserted one of the marked characters the form disallows to include. We figured out that we are able to bypass the validation with terminated strings (%00) and order by statement like (%00BLABLA %20OR%201=1@evolution-sec.com & %00BLABLA%20OR%201=2@evolution-sec.com). After the invalid/malicious input filter mechanism is bypassed the regular validation saves the data to the law enforcement web-application for usage. Request Method(s): [+] POST Vulnerable Service(s): [+] Facebook - Law Enforcement Vulnerable Module(s): [+] Registration Vulnerable Input(s): [+] Email (Account - Token) Proof of Concept: ================= The filter bypass vulnerability can be exploited by remote attackers without privileged web-application user account and without user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Disallowed are the following Character(s): & < > Allowed are the following Character(s): government-lab " %00 / = -- Manual steps to reproduce the vulnerability ... 1. Open the facebook law enforcement web-application 2. Process to register 3. Inject a sql payload to the email 4. Reconfigure the postmaster@ inbox to the payload ibox via dns (catch all) to receive all emails 5. Click the token link and open the application 6. Filter bypassed with invalid or malicious payload in the email context of the dbms 7. Successful reproduce of the email filter bypass vulnerability! Note: We did not try to inject sql commands to the dbms for security reason but it could be possible that the statement finally executes in the dbms by requesting via the web-application. Solution: ========= The filter bypass issue can be patched by a secure encode and parse of the email input field context. Disallow inputs with `single quotes`, `double quotes`, `terminated strings`, `slash` and the `& + =` set characters to prevent a filter bypass. Risk: ===== The security risk of the filter bypass web vulnerability in the facebook law enforcement web-application is estimated as medium. Credits: ======== Vulnerability-Lab [research@vulnerability-lab.com] - https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability Labs or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for incidental or consequential damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. We have no need for criminal activities or membership requests. We do not publish advisories or vulnerabilities of religious-, militant- and racist- hacker/analyst/researcher groups or individuals. We do not publish trade researcher mails, phone numbers, conversations or anything else to journalists, investigative authorities or private individuals. Domains: www.vulnerability-lab.com - www.vulnerability-db.com - www.evolution-sec.com Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get an ask permission. Copyright © 2018 | Vulnerability Laboratory - [Evolution Security GmbH]™