发现漏洞
一个多月后，我就发现了存在facebook ads广告业务系统api中的一个漏洞。存在漏洞的api是一个图片处理接口，它用于facebook商户账户上传广告图片，上传的图片会储存在一个名为“/adimages”的目录下，并用base64格式编码。所以，我的测试构想是，在这里的机制中，可以向上传图片中注入恶意payload，经api转换为 base64 格式后，再被facebook传入服务器中。
以下为上传图片的POST请求：
POST /v2.10/act_123456789/adimages HTTP/1.1Host: graph.facebook.comBytes=VGhpcyBpcyBtYWxpY2lvdXMgcGF5bG9hZC4=
由于Facebook服务器端不能有效地处理恶意Payload图片，最终其“Image Resizing Tool”图片处理工具返回了一个报错，在某个JSON响应内容的异常消息中，就包括了一些PHP库函数代码，这些代码来自不同的Facebook库文件，可以肯定的是，这应该属于Facebook源代码的一部份。
HTTP/1.1 200 OK{“error”:{“message”:”Invalid parameter”,”type”:”FacebookApiException”,”code”:100,”error_data”:”exception ‘Exception’ with message ‘gen_image_rescale_multi_thrift call to shrinkImageMulti failed with fbalgo exception: 43 (43: : IDAT: invalid distance too far back)’ in /var/www/flib/resource/filesystem/upload/upload.php:1393 Stack trace: #0 /var/www/flib/resource/filesystem/upload/upload.php(1662): gen_image_rescale_multi_thrift() #1 /var/www/flib/ads/admanager/adupload/adupload.php(252): gen_image_rescale_multi() #2 /var/www/flib/ads/admanager/adupload/AdImageUtils.php(195): _gen_adupload_image_resize() #3 /var/www/flib/ads/entities/creatives/photos/AdproCreativePhotoDownload.php(53): AdImageUtils::genResizeLocalFile() #4 /var/www/flib/platform/graph/resources/adaccount/adimages/mutators/GraphAdAccountAdImagesPost.php(134): AdproCreativePhotoDownload::addLocalFileToCreativeLibrary() #5 /var/www/flib/core/data_structures/utils/Arrays.php(440): Closure$GraphAdAccountAdImagesPost::genImplementation#3() #6 /var/www/flib/platform/graph/resources/adaccount/adimages/mutators/GraphAdAccountAdImagesPost.php(136): Arrays::genMapWithKey() #7 /var/www/flib/ads/api/graph_base/GraphAdsWriteWithRedirectBase.php(22): GraphAdAccountAdImagesPost->genImplementation() #8 /var/www/flib/ads/api/graph_base/GraphAdsWriteWithRedirectBase.php(11): GraphAdsWriteWithRedirectBase->genDoCall() #9 /var/www/flib/core/asio/gen_utils.php(24): GraphAdsWriteWithRedirectBase->genCall() #10 /var/www/flib/platform/api/base/ApiBaseWithTypedApiData.php(204): genw() #11 /var/www/flib/platform/api/base/ApiBase.php(85): ApiBaseWithTypedApiData->genCallWithApiDataBase() #12 /var/www/flib/platform/graph/core/runner/GraphApiRunnerBase.php(373): ApiBase->genMakeCall() #13 /var/www/flib/platform/graph/core/GraphRequestProcessorBase.php(629): GraphApiRunnerBase->genCall() #14 /var/www/flib/platform/graph/core/GraphRequestProcessorBase.php(45): GraphRequestProcessorBase->genExecuteSingleGraphRequestCore() #15 /var/www/api/graph/server.php(168): GraphRequestProcessorBase->genExecuteSingleGraphRequest() #16 /var/www/api/graph/server.php(174): gen_api_graph_server() #17 /var/www/flib/core/asio/Asio.php(35): gen_api_graph_server_wrapper() #18 (): Closure$Asio::enterAsyncEntryPoint() #19 /var/www/flib/core/asio/Asio.php(37): HHAsiojoin() #20 /var/www/api/graph/server.php(180): Asio::enterAsyncEntryPoint() #21 {main}”,”error_subcode”:1487242,”is_transient”:false,”error_user_title”:”Image Resize Failed”,”error_user_msg”:”Image Resize Failed:unknown reason”,”fbtrace_id”:”EN/o9hmqwZz”},”__fb_trace_id__”:”EN/o9hmqwZz”}
© 版权声明
文章版权归作者所有，未经允许请勿转载。
THE END
