Exploiting odd behaviors in MS Edge & IE to bypass Facebook’s Linkshim

2:32 PM


The following post is inspired by an all charset unicode shazz by @insertscript. After I saw it being referred in a tweet by Gareth Heyes, I immediately started fuzzing for more characters Internet Explorer & MS Edge may interpret horribly, and confuse the anchor host parser to ultimately use and bypass Facebook's Linkshim.

Fuzzing:

<a href=”/[$]example.com” id=”fuzzmeiah”>fuzz</a>
<script>

chars = [];
for(i=0;i<=0xffff;i++){
    if(document.getElementById('fuzzmeiah').hostname==”example.com”) {
      chars.push(i);
      console.log(chars.join('\n'))
     }
}

</script>

Result:
Character 1: 〱- 'VERTICAL KANA REPEAT MARK' (Ux3031)
The first one works for both IE & Edge is 0xE3 0x80 0xB1 (e380b1 aka 〱) , when plugged alone or after a forward slash, confusing the parsers to misinterpret the hostname.
<a href=”/〱example.com” id=”fuzzmeiah”>fuzz</a>
This can be tested in both MS Edge and Internet Explorer by changing links Facebook expects to be relative URIs and thus not passing them to a linkshim validation endpoint, allowing redirection to a blacklisted site (in this example, user must click on continue or cancel)


Character 2: 〵- 'VERTICAL KANA REPEAT MARK LOWERHALF' (Ux3035)


Character 3: ゝ- 'HIRAGANA ITERATION MARK' (0x309d)


Character 4: ー 'KATAKANA-HIRAGANA PROLONGED SOUND MARK' (0x30fc)

Character 5: ｰ 'HALFWIDTH KATAKANA-HIRAGANA PROLONGED SOUND MARK' (0xff70)


This specific issue is not fixed by Facebook as they believe it is more of the browser vendors fault and shouldn't be fixed from their side. Even though I disagree with their decision, I believe a very few percent of Facebook users use IE or Edge so I didn't bother trying to change their mind. I hope this post inspires either Microsoft or Facebook to fix this issue though.

I hope you enjoyed the read. =)

Share This Story

Tags:

You Might Also Like

2 comments

Note: Only a member of this blog may post a comment.