Facebook has rewarded Brazilian computer engineer and security researcher Con Reginaldo Silva with $33,500 (€25,000) for finding and reporting a remote code execution vulnerability. These security holes are not easy to find these days, and so this was the largest amount of money given by Facebook to a security researcher so far.
According to the researcher, it all started in September 2012, when he found an XML External Entity Expansion (XXE) bug in the Drupal component that handles OpenID. OpenID was used by many services, so Silva started running tests to see which service was affected.
Initially, he thought Facebook couldn't be vulnerable, until in November 2013, when he was checking the "Forgot your password"file for over a year facebook.com/OpenID/receiver.php.
immediately reported his findings to Facebook , which patched the vulnerability four hours after Silva submitted his initial report.
The XXe vulnerabilities are serious because they can be exploited to read sensitive files after a request to the web server. However, Silva suspected that he could get even more from the remote code execution flaw. Since Facebook has already fixed the bug, he couldn't test his theory. However, he wrote to Facebook's security team explaining how the bug would escalate to a remote code execution vulnerability.
After his more detailed report, Facebook saw that the theory was correct and that there was indeed an issue with remote code execution. This is why Silva was awarded $33,500 (€25,000) for his work.
“As always, we want our payouts to reward the hard work of researchers who are willing to do the right thing and report bugs,” Facebook explained .
