UPDATED. A researcher received $10,000 from Facebook after uncovering a serious vulnerability and what appeared to be a malicious web shell left behind by hackers on one of the social media giant’s servers. Facebook has clarified that the web shell was actually uploaded by another researcher analyzing the same flaws and noted that user data was never at risk.
Orange Tsai, a consultant at DevCore, had been analyzing Facebook’s infrastructure when he came across a domain called files.fb.com. The domain hosted a login interface for an Accellion File Transfer Appliance, a device used by enterprises for secure file transfers.
While known vulnerabilities had been patched by Facebook in the Accellion product, the researcher discovered a total of 7 previously unknown issues, including cross-site scripting, local privilege escalation, and remote code execution flaws.
The expert leveraged a pre-auth SQL injection vulnerability that allowed remote code execution to upload a webshell to the Facebook server.
Once he gained control of the server, he started collecting information for a Facebook bug bounty report. That was when he discovered that someone had previously uploaded a webshell to the server.
The said webshell attempted to collect the login credentials of Facebook employees who used the file transfer service. Tsai discovered that the script had harvested roughly 300 @fb.com and @facebook.com credentials between February 1 and February 7.
Based on logs found on the server, the researcher determined that unauthorized parties gained access on two occasions — in early July 2015 and mid-September 2015. It’s worth noting that the July “intrusion” took place just days before Rapid7 disclosed a couple of serious vulnerabilities in the Accellion File Transfer Appliance that had been patched by the vendor a couple of weeks earlier.
The expert informed Facebook of the flaws and the existence of the webshell and received a $10,000 reward for his work. The Accellion product vulnerabilities were also reported to the vendor and their details will be made public in the upcoming period.
Facebook told SecurityWeek that the webshell was actually uploaded by another researcher analyzing the same vulnerabilities and there is no reason to believe his activities were malicious in nature. The company clarified that the server exposed by the vulnerabilities in the Accellion product was never part of the systems that run Facebook, including the systems that host user data. Facebook said it no longer uses the vulnerable software.
Facebook reported in February that it had paid researchers more than $4.3 million since the launch of its bug bounty program in 2011.
*Updated to clarify that Facebook said the webshell was actually uploaded by another researcher, not a malicious actor
Related: Facebook Password Reset Flaw Earns Researcher $15,000
Related: Facebook Pays Out $7,500 Bounty for Account Hijacking Flaw
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- GoAnywhere MFT Users Warned of Zero-Day Exploit
- UK Car Retailer Arnold Clark Hit by Ransomware
- EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
- Google Fi Data Breach Reportedly Led to SIM Swapping
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
Latest News
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- China Says It’s Looking Into Report of Spy Balloon Over US
- GoAnywhere MFT Users Warned of Zero-Day Exploit
