4 ms·
Doesn't this XSS constitute a complete compromise of all Facebook user data, globally? (Assuming it had been found by a "bad guy", instead of a white-hat resea
by nh2 11y ago
Doesn't this XSS constitute a complete compromise of all Facebook user data, globally?
(Assuming it had been found by a "bad guy", instead of a white-hat researcher.)
Because:
* He could execute arbitrary code in the browser of any user that views his picture
* Including uploading all private photos and chats of that user to somewhere else
* Or changing their password (assuming 2FA is not used)
* He could have propagated this exploit to all Facebook users by simply uploading his XSS picture into his victim's profile, and from there into second-degree victims, and so on? According to the "6 degrees of separation" theory, this would have been very fast
Or am I missing something?
- grrowl 11y agoHe couldn't have just "uploaded" images to a page, since facebook would output the original path (B1GL0N6H45H.png), where this relies on the .html extension. Easy enough to link people through Messenger or another site to that page, though. The core vector is the fact it's served off the photos.facebook.com domain.
- caf 11y agoA Facebook worm!