The parameter was properly sanitized, & even sent thru Linkshim to validate its not a malicious link. but here is the best part, Linkshim only validates if the link is malicious from a list of database files it have and if it doesn't exisit in the db, it will just put the url in a hyperlink reference.
And I assume because of this Facebook assumed when a link is sent thru linkshim, a link would get out. and they are right, and they are validating everything right. except for the scheme.
Going Beyond AlertThis part is just an extension to prove exploitability. because of Session cookies, this wont be as simple as stealing cookies then saying game over. also because of the limitation factors I wrote above, crafting a normal payload isn't an option.
So I had to use DOM manipulation techniques to get the Authorization button when clicked, authorizing our malicious application to be used on behalf of the user with all the scopes available (comments+likes+basic+public_content+follower_list+relationships)
The pre-final payload I crafted looks like:
As you can see we didn't use any quotes but only the allowed characters, and when visited, that will
authorize the malicious application in-to the users account. :) so the final payload would look something like:
Here is a video poc:
July 24, 2016 - Inital Report
July 26, 2016 - Triage
July 30, 2016 - Patch!