Published On: 13 May 2019
Crashing Users in Facebook Messenger
Other
Facebook | Android
---
LOW VALIDWithin Facebook Messenger their is a feature to tag your friends using the @ symbol. For example doing @Mark would send a notification to Mark saying someones trying to get his attention.
Description
When making the tag Facebook applies an underline to the name to make it more obvious to the viewer. To do this their is a parameter in the post request called &profile_xmd[0][length]. This parameter allowed you to put any number allowing you to tell Facebook you wanted a length of just over 4,000,000,000 which would raise the following error java.lang.IndexOutOfBoundsException: setSpan (0 ... -1) Which would in turn then cause any victim who viewed the message to crash their application.
Impact
The impact of this vary s from each device. In some cases the user was able to restart the app and it would be fixed. Some cases they wouldn't be able to open that chat ever again without crashing. And some required a full reinstall of the app.
Reproduction Steps
Step
1
Tag the victim in your chat of choice and interecept the post request made to send the message
Step
2
Change &profile_xmd[0][length] to a very large number
Step
3
Send the message through
Videos