XSS in Facebook CDN through AR Studio Effects

Proof of Concept

2) Click on Upload AR Studio Effect

3) Scroll to the bottom until you find the section for uploading a “Screencast”

4) Proceed to upload a valid mp4 file

6) Change the filename extension from .mp4 to .html

7) Change the file contents to malicious code

Video

Timeline

Submitted- December 14th, 2017

Triaged- December 14th, 2017 [First time I’ve ever got traiged within the same day :)]

Team Asks for Verification on fix- December 19th, 2017

Bypass to Fix- December 19th, 2017 (The initial fix only verified whether the contents of the file upload contained a video or not and did not check the extension, allowing a user to append javascript to the end of the video contents and change the filename extension to .html for the same results)

Bounty Awarded($1500)- December 20th, 2017 (They awarded the bounty before the fix as they wanted me to be payed before the christmas holiday which was very nice of them)

Full Fix- January 9th, 2018

Related posts:

In this short article, we shall understand a very important concept which will be immensely helpful in the IELTS test. That concept is called mind mapping in IELTS. We shall understand the complete…

Anfang Februar interviewte China Daily USA unseren Gründer Daniel Wang. Dabei teile Daniel seine Ansichten über die Entwicklung und Zukunft des Loopring-Protokolls und DEX (dezentralisierte…

Orange Shithole Rambles Incoherently. So ya know that “brilliant” idea Donald Trump had yesterday to “ARM teachers”? Well I fixed it ;) Enjoy!.