How a Facebook App works
Anyone can create an application (or app) that will run within the
Facebook platform (and many do!). An app is like a regular website with the aditional benifits of the social network Facebook provides (such as friends, profiles boxes, walls etc).
Technically, a Facebook app is just like a website: its mounted on a normal web sever and serves content to HTTP requests.
The difference is that while a normal website receives requests directly from its users, an app has the Facebook platform as a middle man, between the user and the application.

However, Facebook has a module called Automatic Authentication (which sounds like trouble just by its name…). This mechanism allows the app to receive some of the user’s info automatically, without the user’s consent. These details include full name, profile picture, and friends list.

This, as the saying goes, is a feature not a bug. Its a blaring example of the lenient security model Facebook adopted in the name of functionality, or in their own words: “to develop fully-featured social applications with the least possible amount of friction.”
this means any application you access, even before you authorize it, knows quite a lot about you.
But at least you initiated the interaction, right?

The Vulnerability
In the role of the hacker, what we want is to set up an app, have the user’s browser access it without his knowledge, and get all the personal information Facebook’s Automatic Authentication so graciously gives us.
Facebook for their part try to take precautions against just this type of attack. The docs state:

“This parameter (the user ID) will not always appear. If the user has set stronger privacy settings or is redirected from a non-Facebook URL, this parameter will return null.”

Now, 99% of the users do not change their default settings, so the first limitation is not a
problem. But the second is something that requires “fixing”. It means that only if you actually engage the application by clicking a link to it (maybe on somebody’s wall) will the personal info be sent. We need a way to trick Facebook into think the app page it is clandestinitly accessing, is a result of the user’s interaction.

The core of the matter
It turns out that a simple redirect from one page to another in the same application, fools Facebook because the second request originates from a Facebook URL (the first request). Therefore, the second request activates Automatic Authentication and personal info is sent.
To illustrate this imagine the following scenario:

* Browser is directed to

Code:

http://apps.facebook.com/hacker-app/step1.php

Facebook correctly notices that the URL did not originate from with the Facebook domain, and no information is sent. However, step1.php causes a redirect to step2.php.
* Browser is directed to

Code:

http://apps.facebook.com/hacker-app/step2.php

This time, the access seems to have originated from the Facebook domain! Specifically from step1.php. Therefore, personal information is sent along with the request.

Voila.
We have managed to bypass the restriction set forth by AA. But what can we do with this?

The Exploit
Ah, the interesting part.
The simplest way to expoit this is by luring the innocent user to a page on our website (say by sending a link in the mail). In this page we can cause the user’s browser to access any URL (using a hidden IFRAME for example). Specifically we’ll send the user to:

http://apps.facebook.com/hacker-app/step1.php.

This will cause the browser to then go to step2.php and we get the info.

However there is a much more powerful attack possible here (thanks S.B).
We can craft the entire thing in an IMG tag. An IMG tag also causes the browser to go the specified address looking for image data. And if the the browser recieves a redirect response, it relentlesly goes through it looking for those pixels.
The huge difference between the two approches is that many blogs/forum sites allow user comments to contain IMG tags, and therfore the attack can be launched without having the user visit our website. Instead, merely viewing a “treated” forum thread will cause the attack to take place.

The icing on the cake
Hacking is an elegant art. As such, an exploit is messured by its finishing touches, as much as its payload. While having an IMG tag point to

http://apps.facebook.com/hacker-app/step1.php

will work, it is suspicious, and the user ends up with a broken image. So we add:

* IMG tag point to a normal looking URL such as

Lets see this all put together:

Figure 2. The anatomy of the full fledged attack

1. User naively surfs to a well-known and trusted forum at forum.com.
2. The thread he is viewing contains a malicious comment with an IMG tag point at quaji.com
3. The user’s browsers attempts to retrieve the image
4. but instead is redirected to
Code:

http://apps.facebook.com/hacker-app/step1.php

5. The request is forwarded through the Facebook platform,
6. to the hackers app server
7. and is again redirected to
Code:

http://apps.facebook.com/hacker-app/step2.php

8. and back to the browser.
9. Browser attempts
Code:

http://apps.facebook.com/hacker-app/step2.php

10. The Facebook platform passes the request to the hacker’s app server adding the user’s personal information after being tricked into thinking it should do so.
11. To finish off, a redirect is issused to a proper image.

Aftermath
This is special type of CSRF attack in which the hacker not only causes an action on behalf of the user, he is also at the recieving end, obtaining the stolen information.
The attack in its final form is very powerful and it was surprising even to me. While the specific vulnerability in this case was a glitch in the Automatic Authentication process, the rest of the attack is based on the normal behaviour of web browsers and servers. For this reason I presume this attack method is still applicable to Facebook and other sites that collect personal information. If you find another example, I’d love to hear about it.
Original Post :
src

http://blog.quaji.com/2009/08/facebook-csrf-attack-full-disclosure.html