A researcher has discovered a critical vulnerability in Facebook's "Login with Facebook" authentication feature that allows attackers to steal the Access_Token and take full control of the victim's Facebook account.
Facebook uses OAuth 2.0 as an Authorization protocol that helps in token exchange between Facebook and other websites .
The vulnerability lies in the “Login with Facebook” feature, which allowed attackers to create a malicious website and use the access token in various applications, such as Instagram, Oculus, Netflix, Tinder, Spotify , etc. along with Facebook accounts.
Once the attacker compromised the targeted accounts using the stolen tokens, they could gain full read/write permissions to messages, photos, and videos, even if the privacy control is set to “only me.”.
Security researcher Amol Baikar, who discovered this vulnerability, told GBHackers Security that “This critical vulnerability in Facebook could allow account takeovers like Facebook, Instagram, Oculus and more Facebook services. At the same time, the attack can gain access to all websites like Netflix, Tinder, Spotify. (where Facebook login is implemented).”
The vulnerability was reported to Facebook last December, and Facebook released a quick fix for this critical bug. It also issued a $55,000 reward in its bug bounty program.
Access Token theft and account takeover
There are two different points that are important in this vulnerability.
- The “X-Frame-Options” header is missing.
- Additionally, “window.parent”, which stores zero user interaction, did not need to be triggered by window.open or any onClick event.
As a result, cross-domain communications were exposed and the access_token could be leaked to any origin without the victims' knowledge, thus compromising the entire account.
During the research, Amol noticed that the vulnerability leaks 1st party graphql tokens, which help in mutating the search that requires you to add and verify a new phone number for account recovery.
“Since they are whitelisted for GraphQL queries and don’t have to deal with permission checks. They have full read/write permissions on messages, photos, videos, even if the privacy control is set to ‘only me,’” Amol said.
Some of the most important points to note about this Facebook vulnerability are the following:
- All Facebook applications and third party application access tokens could be leaked simultaneously (within seconds).
- The token leak has full read/write/update/delete permissions on the Facebook account. (the attacker can do anything with the Facebook accounts, including adding phone and email which he can later use for password recovery).
- Due to a misconfiguration of the message after sending message, someone visiting an attacker-controlled website could have stolen first-party access credentials for vulnerable applications using Facebook's OAuth flow.
- First party tokens never expire.
- The first party token remains valid even if the user changes the password on their Facebook account. The attacker still has control over the user's account. They can collect the data even if the user changes their password.
Since the vulnerability has existed in the “Login with Facebook” feature for almost 10 years, it is unclear whether hackers have exploited the vulnerability or not. Thus, Facebook users are advised to change their passwords and make sure to log out of all devices and log back in.
