Posted by theharmonyguy in FAXX Hacks | No comments
FAXX Hack: Trazzler
Facebook Verified Application
Current Monthly Active Users: 5,448
Current Rank on Application Leaderboard: 2,833
Application Developer: Trazzler
Responsiveness: The developers at Trazzler have been responsive, and I’ve been working with them to try and get the hole patched. I was honestly a little disappointed by the information they got from Facebook about the hole, but that’s for another post.
Vulnerability Status: Unpatched Patched Sep. 24
Example URI: http://apps.new.facebook.com/trazzler/ajax/browse_navigation/?browse-search=%3Cfb%3Aiframe+src%3D’http%3A%2F%2FEVILURI%2F’%3E
Notes: See the leaderboard rank of Trazzler? I chose to check it after looking at the list of Facebook Verified Applications, which means AppData lists around 2,800 applications I haven’t checked which have higher MAU than Trazzler. This Month of Facebook Bugs only begins to scratch the surface of Facebook applications.
