Security researcher Rafay Baloch claims to have found an open redirect vulnerability in Facebook. To demonstrate his findings, he published a proof-of-concept video on his blog.
Open redirect can be used by cybercriminals to trick victims into thinking that they’re about to visit a safe website, when in fact they’re being directed to an arbitrary domain.
In order to protect its users against attacks that rely on open redirect, Facebook has
implemented a system that warns customers in case they are about to visit a potentially malicious website.
However, the expert identified a way to bypass – at least partly - this protection mechanism. The vulnerability he has discovered is caused by a parameter filtering weakness and it can’t be used as a completely open redirect, but it can be utilized to a certain extent.
The social media network’s representatives acknowledged the existence of the flaw, but it’s uncertain if they will address the issue.
“This endpoint contains a specialized parameter that limits its */usage to a small number of computers and users/*, preventing it from being used as a completely open redirect. For more detailed background information, please see
this note by one of the engineers on the product,” they explained.
Find us on Google+
