Bug Bounty

Thu

Jan

Facebook patched flaw within 9hours - XML Cross Domain Vulnerability

Submitted by Editorial_Staff_Team on Thu, 01/29/2015 - 16:39

Facebook patched flaw within 9hours - XML Cross Domain

On March 25, 2014, Facebook announced that it had agreed to buy Oculus VR for $400 million in cash, $1.6 billion in Facebook stock, and an additional $300 million subject to Oculus VR meeting certain financial targets in a transaction expected to close in the second quarter of 2014.

Since 2012, Oculus website has been in the bug bounty scope for Facebook Bug Bounty at facebook.com/whitehat. The security researcher, Paulos Yibelo discovered a sever flaw in the developers portal of the website (developers.oculus.com), the site was using incorrectly configured crossdomain file that could allow cross domain reads. In a less technical term, that means the ability to read the contents of any HTML file using the victim’s sessions by a simple CSRF exploit.

Wed

Jan

Facebook Bug Bounty - Restriction Filter Bypass Vulnerability (ID 221374210)

Submitted by Editorial_Staff_Team on Wed, 01/14/2015 - 14:09

Facebook Bug Bounty - Restriction Filter Bypass Vulnerability

Today the vulnerability researcher "Paulos Yibelo" (18) discovered a restriction filter bypass vulnerability in the facebook social network web-application. The vulnerability had medium severity. The facebook developer team patched the issue to the new year by coordination of the facebook whitehat security team. The issue was official send as report to the official facebook whitehat bug bounty program.

A restriction/limitation bypass web vulnerability has been discovered in the official Facebook Mobile web-application framework. Facebook limits a name change for 60 days before a new name is applied. The advisory explains how i was able to bypass the restriction to change my `Alternative name` using parameter session tampering.