Hello, everyone, and welcome to this video.
So in this video, we are going to see an awesome bug which was reported by a security researcher to
Facebook for which he was able to get a reward of, in total, thirty one thousand five hundred dollars
for the SRF that he identified.
That's a very, very interesting find.
So I hope you guys learn a lot from this find.
So we are going to do a complete breakdown of this report.
And the best part is we are going to identify the same one lability into other application as well.
So let's quickly start and Facebook is the largest social networking site, and he was able to identify
one of the subdomain after subdomain enumeration and the subdomain was M hyphen.
Nixa start the Facebook dot com.
So whenever the user clicks on that particular subdomain, it redirects him to this end point, which
is slash servlet, slash misti are web admin.
You can observe into the below screenshot and it says you are all blocked.
Please contact your sys admin.
So what he did, he quickly googled the keyword, which was out where Redmond, which was coming into
the end points when he saw the error.
So he observed that it was a business intelligence portal that was built on MicroStrategy.
So MFT R stands for MicroStrategy Overburdensome.
All right.
So we have the clue.
Number one, that we have identified that there is a software of MicroStrategy which is running on my
Phoenixes, not the Facebook dot com with domain that the researcher has identified.
Let's move ahead.
So Googling Mstislav abridgment.
We came to know that, OK, so it is a micro strategy software, and we can also confirm that from this
blog, as you can see.
So it is one of the business intelligence portal known internally as Nix's.
That's why the name of the domain was Nexxus.
All right.
So we have got some of the clues which point that.
The subdomain is being hosted on to MicroStrategy software now moving it from the official configuration
document from MicroStrategy, he identified that there are two to two and points which are publicly
accessible.
This is the first endpoint.
But is your company dot com slash MicroStrategy slash servlet slash Mstislav app?
And second, when is MicroStrategy slash servlet slash TASC proc?
Let's see, which was the endpoint that we were able to see, which is Mystere.
All right.
So we identified that we are able to see one of the endpoint and also these two endpoints are publicly
accessible.
Now, going further into the official configuration document of MicroStrategy, the researcher identified
that the you are l was slash servlet slash Mr Webb.
Then you observe that task does not require any authentication.
So it takes a value from the task only parameter to perform some custom, the regulation and content
generation.
So by enumerating some tasks using the intruder, he was able to identify the validation parameter where
you can see over here you can observe.
And there was something called as a short Yooralla task, which is the process short you order and does
not check for valid authentication system if you did not understand what basically is happening here.
So there is an endpoint, which is this endpoint which has been identified and into this endpoint.
The task I showed you all and the source you are is Google dot com, which the security researcher gave
to try if this domain, which is Facebook is trying to interacting with any third party domain or not.
So for some specific reasons, it did not work.
And you can see the error.
The source, you are told, is not valid, which means the Web application is not making any HDB request
or connection to any third party domain.
So every time it gives me an error message, which is the soul you are told is not valid with a straight
score of 500, which is internal error.
All right.
Then the security researcher thought of downloading the whole application package, which was more than
400.
This is the MicroStrategy software.
So there were several scripts inside which contains some Java files.
Now, this is something which you guys also need to understand that whenever you get stuck at a particular
point of time, the best thing that comes handy is download the whole software package.
For example, if you're working on a party or engineers, try to identify reading from the code itself,
because that is the time when you may identify many hidden potential flaws.
Or so you're the researcher downloaded the whole package and he started looking at each.
Package one by one using Jadeja, I told Sajadi so grateful is used to read the decompiled files of
Java.
Now the main target was short, as we knew that short URL is one of the parameter.
But whenever we try to load Google dot com into it and just through the error.
So finally I found that our class from Gylfi, as you can see over here, and you can see a very, very
interesting thing here where you can see private static, final string allow domain equals to dinny.
You are a dot com.
All right, so we know that there is a specific domain which is only allowed, which is tiny, you all
OK?
So now we know that only tiny Yodle is going to work in there, as you can see into this code.
Now, you're the source who is not valid at a task exception, is there?
If anyone tries to load any are, which is not equal to tiny, all of which does not start with tiny.
So now we know that we are able to load only tiny you are and not anything else, which is Google dot
com that we tried in the start.
So now let's quickly exploit so that it is quickly started.
The collaborative client copied the Bob collaborator's address, went to Dinny You URL and you can see
this is the collaborator.
You all converted it into a tiny.
You are addressed as the tiny Yeoval addresses are allowed Espoo the software configuration and you
can see over here.
So this is that I need you all dot com slash the shortened Yodle which was given as you can see, and
it's successfully connected to the collaborator client.
Perfect.
So we have a HDB request on our collaborator, which means it is an external SRF, so that when it is
present over here, we have identified this.
Let's quickly see whose IP address is this.
And you can see this IP address belongs to Facebook, which can be confirmed from the WHO is recorded,
as you can see here from the website, which is who is dot com slash?
Who is the IP address?
Perfect.
Let's move ahead.
Now it's the time to test the internal SRF.
So we are going to create any sort of invalid internal IP address example, a wrong IP address and inserted
into the source.
You are URL parameter and observe.
There is no response from the server, but you can see there is no response.
But we are going to create a renewal of the internal IP address this time and inserted into the source
you are parameter and observe it.
Ask for http basic authentication, which means the server is running htp basic ot on board ADT, which
can be confirmed over here, which means that we are able to enumerate the internal infrastructure behind
the firewall environment and we are able to see what's running in the back end.
But for some reasons, Facebook said thanks for writing in various features of our site, intentionally
make requests to external users supplied, played host and board.
So long story short, Facebook did not accept it and said we have the protections already in place,
so we don't consider this behavior as a security risk.
So now it's time to dig more deeper.
So what the security researcher did was he tried to increase the impact of the security of this SSRI
by identifying Exercice.
So what he did, he quickly made up of Xerces, hosted on his target website and loaded that target
website using Dinny.
You are all over here and you can see a successful exercice over here which can be used to trick users
and steal credentials.
Perfect second way using a phishing attack with the help of SRF.
So we know the Target website is able to successfully load tiny you all we can create and host of phishing
based on our Facebook login that can steal victims Facebook login credentials, which can look like
a legitimate login portal, as you can see here.
And the word express that could not end is the attackers control domain.
But the attacker will take this domain shorten and using Dinny you are ill and loaded into the source.
You are a barometer of Facebook which will successfully show a page, which is this which is controlled
by the attacker.
So when any victim comes here, login for this credentialled, the attacker is able to get those credentials,
which you can see.
These are the credentials which the user will input and you can see where the attacker is able to successfully
steal the credentials of the user.
Now, this is something which shows our impact.
So the attacker is able to steal the credentials and perform identity theft as well as the attacker
is able to steal cookies using exercice or do a lot of things onto a user's computer.
Next, the researcher was able to fingerprint the internal network of our services, so what he did
was he was able to scan the internal network and send in more than 10000 requests to find an open put
on the server or any application running onto that port.
So what the security researcher did was he made a couple of tiny jewels and started identifying each
board number to see which one is open.
And he identified after scanning a successful application which was running on board, then three zero
three.
And the name of the application was lightweight, which can be seen from this screenshot here.
So before I for further investigate on this, Facebook security team resolved that one liability and
finally was awarded with a bounty of one thousand dollars.
Perfect.
So I hope you guys understood how the security researcher digs in more, deeper and deeper to identify
the potential impact of the vulnerability.
So first thing was to identify that only tiny you will go with the second thing, escalate the necessary
to exercise and a phishing based scenario in which the attacker is able to steal the valid cookies and
section of the user as well as the credentials.
All right, so moving ahead, the security researcher has come to mind one more vulnerability, which
is sensitivity to exposure to increase the bond amount from Facebook.
So is this the end of the story has just begun.
So the security researchers started more fiddling with the software package and he identified one of
the other parameter was also one level, as you can see, all year.
So he identified that third string is again over one parameter.
So he identified one more SSRI.
As you can see, he got a successful request onto his book collaborator Clanked.
So this way, the researcher was able to identify one more SRF into Facebook.
Now, if you move ahead now, this is another one that the researcher has identified, which is sensitive
data exposure.
And because of the sensitive data exposure, the remaining amount of Bondie is added because of the
sensitive data exposure.
For which he was given a bounty of thirty thousand dollars in total.
That's huge.
So now the is also reported that refundability to MicroStrategy because it was into the demo portal
itself, as you can see over here.
So the researcher was able to identify DEUCY information using the A.W. Esmeralda Epper from the MicroStrategy
demo portal, as you can see into that screenshot over here.
And they reported this to MicroStrategy as well.
And they were generous enough to fix it and they gave a bounty of $ 500.
So in total, thirty one thousand five hundred, in which one thousand dollars was for the SRF, three
thousand for sensitive data leakage and five hundred dollars again for the same as SRF.
On to the demo folder of MicroStrategy.
So I hope you guys understand this report.
I'm going to put the link into the description so you can just go over there and read the whole report
again.
In the next video, we are going to replicate the scenario and we are going to identify the same bug
in the live Web website.
Thank you.