Facebook Messenger Remote Denial of Service Vulnerability Report by Social Engineering Neo. Affected Platforms: - Android ≤9 IOS ≤11 Messenger Messenger Lite Tested On: - Android 6 & 7 IOS 11 Messenger (build 228.1.0.10.116) Messenger Lite (build 65.0.1.18.236) Class: - Denial of Service. Summary: - All versions of Messenger Lite and Multiple Versions of Messenger are susceptible to a Remote Denial of Service Vulnerability. Short Description: - A user can remotely crash a user’s Messenger application by sending a message containing a single character. Long Description: - 'ATTACKER' sends a single soft hyphen to 'VICTIM' Upon opening the message, the Messenger application on 'VICTIM' device crashes when loading the single character. Proof of Concept: - #### Tested on Latest Version of Messenger Lite on Android 6 'ATTACKER' send single soft hyphen to 'VICTIM' 'VICTIM' open message sent by 'ATTACKER' #### VIDEO: - https://youtu.be/En1npDpgv_o Expected Result: - It shouldn't be possible to remotely crash the application on a remote user’s device. Observed Result: - Application remotely crashes upon loading message. Our Recommendation: Change the way soft hyphens are loaded in the application. CVSS v3 Vector: - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:F/RL:O/RC:R/CR:X/IR:X/AR:X/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:N/MI:L/MA:H CVSS Base Score: - 8.2 Impact Subscore: - 4.2 Exploitability Subscore: - 3.9 CVSS Temporal Score: - 7.3 CVSS Environmental Score: - 7.3 Modified Impact Subscore: - 4.2 Overall CVSS Score: - 7.3 CVSS v2 Vector: - AV:N/AC:L/Au:N/C:N/I:P/A:C/E:F/RL:OF/RC:UR/CDP:LM/TD:M/CR:ND/IR:ND/AR:ND CVSS Base Score: - 8.5 Impact Subscore: - 7.8 Exploitability Subscore: - 10.0 CVSS Temporal Score: - 6.7 CVSS Environmental Score: - 5.7 Modified Impact Subscore: - 7.8 Overall CVSS Score: - 5.7 TIMELINE: - Discovery 2017 : - Initial Report 23rd August 2019 : - Case Opened 23rd August 2019 : - Added Detail 24th August 2019 *Public Disclosure Date: - Sep 18th 2019 UTC -08:00 (25 days from initial report)* : - Added Detail 27th August 2019 : - Response 27th August 2019 : - Added Detail 27th August 2019 : - Response 29th August 2019 : - Added Detail 29th August 2019 : - Response 1st September 2019 : - Added Detail 1st September 2019 : - Case Closed 5th September 2019 *PATCH RELEASED PUBLICLY* : - Added Detail 5th September 2019 *Public Disclosure Date: - Jul 6th 2019 UTC -08:00 (24 hours from patch)* : - We thank the Facebook Security team for their quick patch.