Prakhar Prasad, a Web application security Researcher, has discovered Open Redirection vulnerability in the Facebook mobile website(m.facebook.com).
Usually, when you try to visit external links in facebook, the url will be passed to "l.php" page that will displays "Leaving Facebook" message before redirecting. So if it is malicious link, the page will show warning message.
But Prasad discovered one of the page in Facebook mobile redirects user directly to the external link.
POC:
Researcher immediately sent notification to Facebook about the vulnerability . Facebook fixed the vulnerability and rewarded researcher with $500.
An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it
Usually, when you try to visit external links in facebook, the url will be passed to "l.php" page that will displays "Leaving Facebook" message before redirecting. So if it is malicious link, the page will show warning message.
But Prasad discovered one of the page in Facebook mobile redirects user directly to the external link.
POC:
http://m.facebook.com/video_redirect/?src=http://www.google.comHe found this vulnerability when he tried to view the uploaded video on Facebook mobile website.
Researcher immediately sent notification to Facebook about the vulnerability . Facebook fixed the vulnerability and rewarded researcher with $500.