Facebook Mobile Open Redirection Vulnerability

Sometime back, I found an open redirect vulnerability in Facebook mobile site (http://m.facebook.com)

According to OWASP:

So typically what happens in Facebook is that whenever you try to visit any external links, the URL is first thrown to l.php (See the note from Facebook Security here) and then l.php redirects to the website and before redirecting if l.php finds the website to be marked malicious then it won't redirect and will display an error message.

Now one fine day while browsing the Facebook mobile website I noticed someone had uploaded a video on Facebook so I tried to view it by clicking the video thumbnail and a download pop-up appeared.On careful examination the link Facebook used to generate the URL was like this:

m.facebook.com/video_redirect/?src=[LINK_TO_VIDEO]

So I manipulated the 'src' parameter to something like http://www.google.com, so the link became:

m.facebook.com/video_redirect/?src=http://www.google.com

Whoa! It successfully redirected to http://www.google.com, so this was the issue.

Facebook fixed this issue within two weeks and offered a monetary reward of $500 USD



I will be featured in Facebook Thank You! List soon.