Facebook JavaScript and Security
Written by on August 8th, 2007 in Ajax News.
Neil Mix was skeptical that FBJS could be secure. He then quickly found a couple of holes but didn’t disclose them until he had chatted with the Facefolk.
Neil is publishing the exploits after they are fixed. What a nice white hat he wears:
The first security hole was the easiest and least interesting hack. It bypasses access control #1 by making use of an old, arcane behavior of the setTimeout method, namely that you can pass a string as the code to execute:
JAVASCRIPT:
Facebook (or more specifically Marcel Laverdet) fixed this by checking the datatype of the first argument to setTimeout
Neil got access to running arbitrary code via the Function constructor.
-
-
var F = (function(){}).constructor;
-
var exploit = new F(”alert(’arbitrary code’));
-
exploit();
The fix was simple:
-
-
Function.prototype.constructor = null;
-
Neil has four more in the bag, so hopefully we will see then as soon as Facebook fixes them. It is good to see the community working with Facebook on the issues, instead of just throwing up arms.
Source: Ajaxian
Original Article: http://feeds.feedburner.com/~r/ajaxian/~3/141941277/facebook-javascript-and-security