Facebook (Law Enforcement) - Filter Bypass Vulnerability

Document Title:
===============
Facebook (Law Enforcement) - Filter Bypass Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1774


Release Date:
=============
2016-10-01


Vulnerability Laboratory ID (VL-ID):
====================================
1774


Common Vulnerability Scoring System:
====================================
3.9


Vulnerability Class:
====================
Filter or Protection Mechanism Bypass


Current Estimated Price:
========================
2.000€ - 3.000€


Product & Service Introduction:
===============================
Facebook is a corporation and online social networking service headquartered in Menlo Park, California, in the United States. Its website was launched on 
February 4, 2004, by Mark Zuckerberg with his Harvard College roommates and fellow students Eduardo Saverin, Andrew McCollum, Dustin Moskovitz and Chris 
Hughes. The founders had initially limited the websites membership to Harvard students, but later expanded it to colleges in the Boston area, the Ivy 
League, and Stanford University. It gradually added support for students at various other universities and later to high-school students. Since 2006, 
anyone who is at least 13 years old was allowed to become a registered user of the website, though the age requirement may be higher depending on 
applicable local laws. Its name comes from the face book directories often given to American university students.

(Copy of the Homepage: https://en.wikipedia.org/wiki/Facebook )

These operational guidelines are for law enforcement officials seeking records from Facebook. For private party requests, including requests from civil 
litigants and criminal defendants, visit: facebook.com/help/?page=1057. Users seeking information on their own accounts can access Facebook’s “Download 
Your Information” feature from their account settings. See facebook.com/help/?page=18830. This information may change at any time.

(Copy of the Homepage: https://www.facebook.com/safety/groups/law/guidelines/ )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Core Research Team discovered a filter bypass vulnerability in the official Facebook (Law Enforcement) web-application.


Vulnerability Disclosure Timeline:
==================================
2016-10-02: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Remote


Severity Level:
===============
Low


Authentication Type:
====================
Open Authentication (Anonymous Privileges)


User Interaction:
=================
No User Interaction


Disclosure Type:
================
Responsible Disclosure


Technical Details & Description:
================================
A filter bypass web vulnerability has been discovered in the official Facebook Law Enforcement online service web-application.
The vulnerability allows remote attackers to bypass the secure filter and protection mechanism of an input to the application dbms.

The basic email filter validation of the law enforcement registration disallow special chars like script codes and other 
invalid characters. The validation procedure approval of the input approves whether there is a valid email or an invalid input. 
By approving the filter validation of the registration email procedure we was able to figure out how to bypass the basic filter 
validation to inject invalid or malicious context to the dbms.

The filter validation disallows for example >,<(script),,(no@domain) and &. As far as an account inserted one of the marked characters 
the form disallows to include. We figured out that we are able to bypass the validation with terminated strings (%00) and order by statement 
like (%00BLABLA %20OR%[email protected]  &  %00BLABLA%20OR%[email protected]). After the invalid/malicious input filter mechanism 
is bypassed the regular validation saves the data to the law enforcement web-application for usage.

Request Method(s):
				[+] POST
Vulnerable Service(s):
				[+] Facebook - Law Enforcement
Vulnerable Module(s):
				[+] Registration
Vulnerable Input(s):
				[+] Email (Account - Token)


Proof of Concept (PoC):
=======================
The filter bypass vulnerability can be exploited by remote attackers without privileged web-application user account and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Disallowed are the following Character(s):	&  < >
Allowed are the following Character(s): 	government-lab  "  %00  /   =   --

Manual steps to reproduce the vulnerability ...
1. Open the facebook law enforcement web-application
2. Process to register
3. Inject a sql payload to the email
4. Reconfigure the postmaster@  inbox to the payload ibox via dns (catch all) to receive all emails
5. Click the token link and open the application
6. Filter bypassed with invalid or malicious payload in the email context of the dbms
7. Successful reproduce of the email filter bypass vulnerability!

Note: We did not try to inject sql commands to the dbms for security reason but it could be possible that the statement finally executes in the dbms by requesting via the web-application.


Solution - Fix & Patch:
=======================
The filter bypass issue can be patched by a secure encode and parse of the email input field context.
Disallow inputs with `single quotes`, `double quotes`, `terminated strings`, `slash` and the `& + =` set characters to prevent a filter bypass.


Security Risk:
==============
The security risk of the filter bypass web vulnerability in the facebook law enforcement web-application is estimated as medium.


Credits & Authors:
==================
Vulnerability-Lab [[email protected]] - https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or 
implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any 
case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability Labs or its 
suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for incidental
or consequential damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface 
websites, hack into databases or trade with stolen data. We have no need for criminal activities or membership requests. We do not publish advisories 
or vulnerabilities of religious-, militant- and racist- hacker/analyst/researcher groups or individuals. We do not publish trade researcher mails, 
phone numbers, conversations or anything else to journalists, investigative authorities or private individuals. 

Domains:    www.vulnerability-lab.com		- www.vulnerability-db.com					- www.evolution-sec.com
Programs:   vulnerability-lab.com/submit.php 	- vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php
Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- vulnerability-lab.com/rss/rss_news.php
Social:	    twitter.com/vuln_lab		- facebook.com/VulnerabilityLab 				- youtube.com/user/vulnerability0lab

Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark 
of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get an ask permission.

				    Copyright © 2018 | Vulnerability Laboratory - [Evolution Security GmbH]™