<style>/*<link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8609705495647172048&zx=e9353385-a227-4f57-bc41-7fe333d57344' media='none' onload='if(media!='all')media='all'' rel='stylesheet'/><noscript><link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8609705495647172048&zx=e9353385-a227-4f57-bc41-7fe333d57344' rel='stylesheet'/></noscript>
<meta name='google-adsense-platform-account' content='ca-host-pub-1556223355139109'/>
<meta name='google-adsense-platform-domain' content='blogspot.com'/>

<!-- data-ad-client=ca-pub-9701995977772178 -->

</head><body>*/</style>

Student Gets Rewarded For Facebook Bug Bounty Program

20 Mar, 2013

Namaste! Good Morning,

A Computer Science Student of Comsats Institute of information technology Islamabad (Pakistan) named Haider

Mehmood took part in Facebooks Bug Bounty Program and has been rewarded $500 for finding and reporting a HTML Injection Vulnerability.

The details of the bug are as follows :

Vulnerability title: HTML Injection

Vendor homepage: http://m.facebook.com

Remote/Local: Remote

Tested on: Windows 7 64 bit Firefox browser (but should have worked on other OS and browsers (not sure about IE))

Vulnerability Submitted on: 12/1/2013

Vulnerability Status: FIXED / PATCHED

Vulnerable Parameter: https://m.facebook.com/survey.php?incorrect_brand&params=

Facebook makes survey to evaluate the mobile user experience as they surf facebook mobile site. Here is the survey https://m.facebook.com/survey.php . When entering the mobile phone brands it provides a list of brands in case you typed an incorrect brand.

The list of mobile brands provided in the survey were :

The list of phone brands that was provided contained HTML code inside the parameter...

https://m.facebook.com/survey.php?incorrect_brand&params=[HTML code of Brands and Radio Buttons]

A remote user was able to add any brand Name and Radio buttons therefor allowing remote HTML injection. It was as simple as it sounds.

PoC Haider Sumbitted to Facebook:

Facebook replied and they acknowledged the issue

Facebook then replied after two months when they patched the vulnerability

They then emailed Haider regarding the eligibility of the bug bounty program and details for the bounty .

<style>/*
<script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/745881458-widgets.js"></script>
<script type='text/javascript'>
window['__wavt'] = 'AOuZoY6NiJTEV9zlPn6-KnGRENz2HQ_eUg:1734796532179';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d8609705495647172048','//www.timesofhacker.com/2013/03/student-gets-rewarded-for-facebook-bug-bounty-program.html','8609705495647172048');
_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '8609705495647172048', 'title': 'THE TIMES OF HACKER', 'url': 'https://www.timesofhacker.com/2013/03/student-gets-rewarded-for-facebook-bug-bounty-program.html', 'canonicalUrl': 'https://www.timesofhacker.com/2013/03/student-gets-rewarded-for-facebook-bug-bounty-program.html', 'homepageUrl': 'https://www.timesofhacker.com/', 'searchUrl': 'https://www.timesofhacker.com/search', 'canonicalHomepageUrl': 'https://www.timesofhacker.com/', 'blogspotFaviconUrl': 'https://www.timesofhacker.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': true, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'UA-37858254-1', 'encoding': 'UTF-8', 'locale': 'en-GB', 'localeUnderscoreDelimited': 'en_gb', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22THE TIMES OF HACKER - Atom\x22 href\x3d\x22https://www.timesofhacker.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22THE TIMES OF HACKER - RSS\x22 href\x3d\x22https://www.timesofhacker.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22THE TIMES OF HACKER - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/8609705495647172048/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22THE TIMES OF HACKER - Atom\x22 href\x3d\x22https://www.timesofhacker.com/feeds/4332371789247634031/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseClientId': 'ca-pub-9701995977772178', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': true, 'adsenseAutoAds': false, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/361ce9cf7a112c52', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'X', 'key': 'twitter', 'shareMessage': 'Share to X', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en_GB\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'item', 'postId': '4332371789247634031', 'postImageThumbnailUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi24pgCxFg7UPbfiFfX14zq2YwmR3qwBSr1Af7qRW_vXK9FJm2hHHiYD6J4st3yKJuH3dh7b-osg31svzH11XZDWq3lzi91gIXoUD75f_shyphenhypheni11W_kKVNJxj64EoJmNpyHldwT6r6RJMZO2/s72-c/parameters_fbbug1.jpg', 'postImageUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi24pgCxFg7UPbfiFfX14zq2YwmR3qwBSr1Af7qRW_vXK9FJm2hHHiYD6J4st3yKJuH3dh7b-osg31svzH11XZDWq3lzi91gIXoUD75f_shyphenhypheni11W_kKVNJxj64EoJmNpyHldwT6r6RJMZO2/s400/parameters_fbbug1.jpg', 'pageName': 'Student Gets Rewarded For Facebook Bug Bounty Program', 'pageTitle': 'THE TIMES OF HACKER: Student Gets Rewarded For Facebook Bug Bounty Program', 'metaDescription': ''}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard', 'ok': 'Ok', 'postLink': 'Post link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'Student Gets Rewarded For Facebook Bug Bounty Program', 'description': 'THE TIMES OF HACKER is the archive of Hackers activity around the World with the latest Hackers News and Cyber security updates.', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi24pgCxFg7UPbfiFfX14zq2YwmR3qwBSr1Af7qRW_vXK9FJm2hHHiYD6J4st3yKJuH3dh7b-osg31svzH11XZDWq3lzi91gIXoUD75f_shyphenhypheni11W_kKVNJxj64EoJmNpyHldwT6r6RJMZO2/s400/parameters_fbbug1.jpg', 'url': 'https://www.timesofhacker.com/2013/03/student-gets-rewarded-for-facebook-bug-bounty-program.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 4332371789247634031}}, {'name': 'widgets', 'data': [{'title': 'Social Icons', 'type': 'HTML', 'sectionId': 'upload-image', 'id': 'HTML7'}, {'title': 'Social Links', 'type': 'HTML', 'sectionId': 'upload-image', 'id': 'HTML1'}, {'title': 'Logo', 'type': 'HTML', 'sectionId': 'header-main', 'id': 'HTML10'}, {'title': 'Icons, Dark, Search', 'type': 'LinkList', 'sectionId': 'header-main', 'id': 'LinkList10'}, {'title': 'Menu', 'type': 'LinkList', 'sectionId': 'header-main', 'id': 'LinkList11'}, {'title': 'Featured Post', 'type': 'FeaturedPost', 'sectionId': 'before-blog', 'id': 'FeaturedPost1', 'postId': '7497894115651499685'}, {'title': '', 'type': 'HTML', 'sectionId': 'before-post', 'id': 'HTML4'}, {'title': 'Blog Posts', 'type': 'Blog', 'sectionId': 'blog-post', 'id': 'Blog1', 'posts': [{'id': '4332371789247634031', 'title': 'Student Gets Rewarded For Facebook Bug Bounty Program', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi24pgCxFg7UPbfiFfX14zq2YwmR3qwBSr1Af7qRW_vXK9FJm2hHHiYD6J4st3yKJuH3dh7b-osg31svzH11XZDWq3lzi91gIXoUD75f_shyphenhypheni11W_kKVNJxj64EoJmNpyHldwT6r6RJMZO2/s400/parameters_fbbug1.jpg', 'showInlineAds': true}], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': 'd MMM, yyyy'}]}, 'footerBylines': [{'regionName': 'footer2', 'items': [{'name': 'labels', 'label': ''}]}], 'allBylineItems': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': 'd MMM, yyyy'}, {'name': 'labels', 'label': ''}]}, {'title': '#You may also like', 'type': 'HTML', 'sectionId': 'ads-post', 'id': 'HTML15'}, {'title': 'Slider [On/Off]', 'type': 'HTML', 'sectionId': 'after-blog', 'id': 'HTML5'}, {'title': 'Popular Posts', 'type': 'PopularPosts', 'sectionId': 'sidebar-static', 'id': 'PopularPosts10', 'posts': [{'title': 'Ransomware Asks Extra Payment To Delete Files', 'id': 4118881104777075466}, {'title': 'Trojan njRAT Has Learned To Encrypt User Files And Steal Cryptocurrency', 'id': 1300980682596938142}, {'title': 'Hack In Paris Invites All The Hackers of The World', 'id': 5373383239052815871}, {'title': 'Google Down in 2020 , May Day! May Day! May Day!', 'id': 1305235622525805092}, {'title': 'Associations And Organisations In The CIS Are Assaulted By The Small PYLOT', 'id': 6624419482163596255}]}, {'title': 'Categories', 'type': 'Label', 'sectionId': 'sidebar-static', 'id': 'Label10'}, {'title': 'Hashtag', 'type': 'Label', 'sectionId': 'sidebar-static', 'id': 'Label11'}, {'title': 'Blog Archive', 'type': 'BlogArchive', 'sectionId': 'sidebar-static', 'id': 'BlogArchive10'}, {'title': '#Recent Post', 'type': 'HTML', 'sectionId': 'sidebar-static', 'id': 'HTML19'}, {'title': 'About Us', 'type': 'HTML', 'sectionId': 'footer-widget', 'id': 'HTML21'}, {'title': 'Learn More', 'type': 'LinkList', 'sectionId': 'footer-widget', 'id': 'LinkList13'}, {'title': 'Follow Us', 'type': 'LinkList', 'sectionId': 'footer-widget', 'id': 'LinkList14'}, {'title': 'Newsletter', 'type': 'HTML', 'sectionId': 'footer-widget', 'id': 'HTML22'}, {'title': 'Copyright', 'type': 'HTML', 'sectionId': 'copyright', 'id': 'HTML23'}, {'title': 'SVG Icons', 'type': 'HTML', 'sectionId': 'jet-options', 'id': 'HTML24'}]}]);
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML7', 'upload-image', document.getElementById('HTML7'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML1', 'upload-image', document.getElementById('HTML1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML10', 'header-main', document.getElementById('HTML10'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList10', 'header-main', document.getElementById('LinkList10'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList11', 'header-main', document.getElementById('LinkList11'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_FeaturedPostView', new _WidgetInfo('FeaturedPost1', 'before-blog', document.getElementById('FeaturedPost1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML4', 'before-post', document.getElementById('HTML4'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'blog-post', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML15', 'ads-post', document.getElementById('HTML15'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML5', 'after-blog', document.getElementById('HTML5'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PopularPostsView', new _WidgetInfo('PopularPosts10', 'sidebar-static', document.getElementById('PopularPosts10'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LabelView', new _WidgetInfo('Label10', 'sidebar-static', document.getElementById('Label10'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LabelView', new _WidgetInfo('Label11', 'sidebar-static', document.getElementById('Label11'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogArchiveView', new _WidgetInfo('BlogArchive10', 'sidebar-static', document.getElementById('BlogArchive10'), {'languageDirection': 'ltr', 'loadingMessage': 'Loading\x26hellip;'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML19', 'sidebar-static', document.getElementById('HTML19'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML21', 'footer-widget', document.getElementById('HTML21'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList13', 'footer-widget', document.getElementById('LinkList13'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList14', 'footer-widget', document.getElementById('LinkList14'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML22', 'footer-widget', document.getElementById('HTML22'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML23', 'copyright', document.getElementById('HTML23'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML24', 'jet-options', document.getElementById('HTML24'), {}, 'displayModeFull'));
</script>
</body>*/</style>