Facebook to patch email address vuln

Facebook has confirmed it will patch a vulnerability that allows any account to be compromised.

Vulnerability researcher Dan Melamed said attackers could reset account passwords by luring logged-in Facebook victim to visit a specific link.

The vulnerability exists in the ‘claim email address' component of Facebook. When a user tries to add an email address that already exists in the Facebook system, they have the option to ‘claim it'.

However when claiming an email address, Facebook does not verify the request came from which allowed an email to be claimed on any Facebook account.

Attackers would need two Facebook accounts: one with the email address to be claimed already added to it and another to initiate the claim process.

Once the victim clicks on the link, the rogue email is instantly added to their Facebook account," Melamed said.

"The victim does not receive any notification whatsoever that this email has been added.

“The hacker can then reset the victim's password using the newly added email address. Thus allowing the attacker to take complete control over the Facebook account.”

According to security blogger Graham Cluley, Melamed was awarded $1,500 by Facebook's bug bounty initiative for responsibly disclosing the vulnerability to the social network.

The link was valid for three hours.

This article originally appeared at scmagazineuk.com