In a Facebook FBML application some elements are protected with fb_protected=”true”. When transversing the elements with getElementsByTagName sub elements of the protected element can be accessed.
A malicious application would place a comment box inside a facebook application or in an iframe with http://www.facebook.com/plugins/serverfbml.php. The site would then use the javascript call getElementsByTagName to locate the textarea and use setValue to fill it out. The same technique could be used to set the “Post on wall” checkbox. Finally getElementsByTagName call would then find the only form instance and call the submit function to post the new comment. This would be 100% automated and transparent to the user.
Personal Information (all friends and groups) Leakage
An FBML mutly-friend selector is used. Then applying the same technique as above the malicious application can locate all links inside the elements. The links contain a title attribute with each friends full name (ele.getTitle). The neighboring div contains a background style that can also be read to get the friends profile picture and user ID.
- How do you reproduce the issues?
Comment box with wall post.
Personal Information (all friends and groups) Leakage
iFramed URL via serverfbml.php:
In this example a text area is simply filled with the user data. In a real life example this data would be sent to the attackers server, or used to send misleading information.