Facebook features file uploading ability in message. Facebook security won't allow users to upload Executable files(.EXE files). Nathan Power, A Security Researcher from securitypentest discovered a New vulnerability in Facebook file uploading feature that leads to uploading EXE files. For sending message , you don't need to be friend.
Vulnerability Description:
Facebook security display Error message whenever user try to upload file. Whenever uploading a file, the facebook sends POST request to server. The researcher noticed the parameters of POST method.
Content-Disposition: form-data; name="attachment"; filename="cmd.exe"Here you can notice filename parameter is used to send the file name. This variable is used to check the file type whether it is allowed to upload or not. If it is .exe file , it will be rejected. Researcher append white space in the end of file in order to bypass the checking. Successfully it worked for him.
 |
| Post Request Contents |
He reported to Facebook about this vulnerability and they now fixed.
