Facebook Cross Site Scripting

`=============================================  
INTERNET SECURITY AUDITORS ALERT 2010-001  
- Original release date: January 8th, 2010  
- Last revised: February 3rd, 2010  
- Discovered by: Juan Galiana Lara  
- Severity: 6.3/10 (CVSS Base Score)  
=============================================  
  
I. VULNERABILITY  
-------------------------  
Facebook HTML and Script code injection vulnerability  
  
II. BACKGROUND  
-------------------------  
Facebook is a social networking website that is operated and privately  
owned by Facebook, Inc. Users can add friends and send them messages,  
and update their personal profiles to notify friends about themselves.  
Additionally, users can join networks organized by city, workplace,  
school, and region. The website's name stems from the colloquial name  
of books given at the start of the academic year by university  
administrations with the intention of helping students to get to know  
each other better.  
  
III. DESCRIPTION  
-------------------------  
The mobile interface of Facebook social network is affected by  
Cross-Site Scripting vulnerability due variable "q" is not properly  
sanitized in http://m.facebook.com/friends.php.  
  
An attacker can inject HTML or script code in the context of victim's  
browser, so can perform XSS attacks, and steal cookies of a targeted user.  
  
IV. PROOF OF CONCEPT  
-------------------------  
http://m.facebook.com/friends.php?q=%3Cscript%3Ealert(%22XSS%22)%3B%3C%2Fscript%3E  
  
V. BUSINESS IMPACT  
-------------------------  
An attacker can execute arbitrary HTML or script code in a targeted  
user's browser, this can leverage to steal user targeted cookies.  
  
VI. SYSTEMS AFFECTED  
-------------------------  
Facebook  
  
VII. SOLUTION  
-------------------------  
Corrected  
  
VIII. REFERENCES  
-------------------------  
http://www.facebook.com  
http://www.isecauditors.com  
http://juangaliana.blogspot.com  
  
IX. CREDITS  
-------------------------  
This vulnerability has been discovered  
by Juan Galiana Lara (jgaliana (at) isecauditors (dot) com).  
  
X. REVISION HISTORY  
-------------------------  
January 8, 2010: Initial release.  
February 3, 2010: Last revision.  
  
XI. DISCLOSURE TIMELINE  
-------------------------  
January 2, 2010: Discovered by Internet Security Auditors.  
January 9, 2010: Vendor contacted including PoC. No response.  
January 11, 2010: Second contact. No response.  
January 19, 2010: Third contact. No response.  
January 20, 2010: Vulnerability corrected without any  
kind of contact.  
January 31, 2010: Response from Facebook Security member  
requiring info.  
February 3, 2010: Sent to lists for public interest.  
  
XII. LEGAL NOTICES  
-------------------------  
The information contained within this advisory is supplied "as-is"  
with no warranties or guarantees of fitness of use or otherwise.  
Internet Security Auditors accepts no responsibility for any damage  
caused by the use or misuse of this information.  
`