A story of a $9500 bug in Facebook OAuth 2.0
Andrey Labunets has made a blog posting regarding the OAuth 2.0 flaws he discussed during his talk at HITBSecConf2013 - Amsterdam (PDF).
Recently, I have made a talk at the Hack In The Box conference, where I have wrapped up multiple weaknesses in Facebook authorization protocol OAuth 2.0, reported by me during 2012-2013. Many of those bugs led to access token leaking and to taking (restricted) control over Facebook account, but the most interesting OAuth issue resulted in cross-site scripting. By this moment, the XSS bug is mostly patched by Facebook Security team.
Exploitation of this XSS is quite complicated, and though I have put a few pictures on my slides to explain the flow, nothing can be clearer than a well-formatted bug report itself. Here I am publishing my original advisory with a proof-of-concept code, which I had sent to Facebook Security team, describing the full chain of problems and some mitigation proposals as well.
