Facebook Privacy Issue: Yet Another Vulnerability Exposed

more images

As Facebook privacy crisis continues to deface the company’s image, vulnerabilities in the site doesn’t seem to fall off. The social networking ace already facing a series of allegations. Alert Logic’s Senior Security Analyst, M.J. Keith, has unearthed yet another bug in Facebook that can lead to exposure of private information or defacement of users pages. Attackers can exploit the vulnerability to place a specially crafted link when members sign into Facebook. With it the attacker will be able to modify users privacy settings or alter the user’s profile. Alert Logic provides an instance of vulnerability, which we’d like to share with you.

Facebook uses a token called “post_form_id” to prevent CSRF attacks. When an attacker created a page with an automatic post and deleted the “post_form_id” completely the server side script would not attempt to validate the request and save the submitted values.

Alert Logic worked out a solution for issue with Facebook. Facebook  confirmed that the flaws has been patched.

Facebook set out a word of precaution for its users, recommending them not to click on suspicious links, even if the link was sent to a friend.