Facebook to patch email address flaw

News by Dan Raywood

Facebook has confirmed it will patch a vulnerability that allows any account to be compromised.

Facebook has confirmed it will patch a vulnerability that allows any account to be compromised.

According to details from Dan Melamed, if a victim is logged into Facebook an attacker can lure the victim to visit a website link and once the link has loaded, the attacker is able to reset the victim's password.

He said that the vulnerability exists in the ‘claim email address' component of Facebook and when a user tries to add an email address that already exists in the Facebook system, they have the option to ‘claim it'. However when claiming an email address, Facebook does not check who the request came from and this allows an email to be claimed on any Facebook account.

In order for an attacker to conduct this, they will need two Facebook accounts: one account with the email address (that you want to claim) already added to it; and another account to initiate the claim process. Once the victim clicks on the link, the rogue email is instantly added to their Facebook account.

Melamed said: “The victim does not receive any notification whatsoever that this email has been added.

“The hacker can then reset the victim's password using the newly added email address. Thus allowing the attacker to take complete control over the Facebook account.”

According to security blogger Graham Cluley, Melamed was awarded $1,500 (£993) by Facebook's bug bounty initiative for responsibly disclosing the vulnerability to the social network.

He said: “Dan Melamed says that the link does not expire for approximately three hours, giving plenty of time for abuse. He has made a video demonstrating how the attack works. I recommend watching the video full-screen in HD to get the most out of it, and note that there is no soundtrack.”


Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews