3 ms·

Thanks for explanation. May I ask how the attacker can make "an oauth query to Facebook with the redirect URL hacked so that it points at foo.com/links?url=evil

by tlogan 14y ago

Thanks for explanation. May I ask how the attacker can make "an oauth query to Facebook with the redirect URL hacked so that it points at foo.com/links?url=evil.com"? Are you saying that attacker somehow convinces user to visit maliciously created Facebook authentication URL?

homakov 14y ago
not precisely visit, any CSRF technique can be useful. <iframe, window.open
icambron 14y ago
Right, I worded that poorly. You need some other vulnerability for the attacker to pull this trick off. But, like homokov says, there are a lot of possibilities for that. Obviously, such a vulnerability is bad on its own and the site owner should prevent it, but FB should be better about mitigating it from their end.