Wednesday, August 8th, 2007
Facebook JavaScript and Security
Category: Social Networks
Neil Mix was skeptical that FBJS could be secure. He then quickly found a couple of holes but didn't disclose them until he had chatted with the Facefolk.
Neil is publishing the exploits after they are fixed. What a nice white hat he wears:
The first security hole was the easiest and least interesting hack. It bypasses access control #1 by making use of an old, arcane behavior of the setTimeout method, namely that you can pass a string as the code to execute:
JAVASCRIPT:
Facebook (or more specifically Marcel Laverdet) fixed this by checking the datatype of the first argument to setTimeout
Neil got access to running arbitrary code via the Function constructor.
-
-
var F = (function(){}).constructor;
-
var exploit = new F("alert('arbitrary code'));
-
exploit();
The fix was simple:
-
-
Function.prototype.constructor = null;
-
Neil has four more in the bag, so hopefully we will see then as soon as Facebook fixes them. It is good to see the community working with Facebook on the issues, instead of just throwing up arms.
That means the black hat hackers where afraid of CIA if they didn’t tryed anything fishy on FB?
what about:
=============
var exploit = new Function(”alert(’arbitrary code’)”);
exploit ();
=============
that’s what Neil did, but in a long way. :/
Matjaz: Take a moment to read up on what FBJS is and how it works, the need for acrobatics will become clearer then. FBJS rewrites the code so that all global accesses are prefix by an identifier unique to your application. Any reference to the global “Function” get rewritten to something like “asdf_Function”. So it’s not as simple as what you propose, hence the “long way” (which has since been fixed by Facebook).
I imagine FB are going to have to step very, very carefully to prevent XSS-style holes in this service. Fortunately they have Joe Hewitt on their side. ;)
just posted in my blog …
delete Function;(this.Function||parent.Function)("alert('safe?')")();uhm … above behaviour is correct only in a sandbox (but it works with FireFox, everytime)
Where can I get the demo?
I need some help. Can anyone tell me how can i use javascript with face book. i cannot even use alert(). Please explain as well.
I cannot use facebook properly, it keeps telling me to upgrade the javascript, how do i do this ?