A cybersecurity company revealed Monday details surrounding a vulnerability that could have exposed data on Facebook users.
The bug, connected to Facebook’s Search system, was patched by the social media site in May after being reported by Ron Masas, a security researcher with Imperva.
Masas discovered that the search feature was vulnerable to cross-site request forgery attacks, which could allow a malicious website to gather data on a Facebook user while they’re logged in.
“This allowed information to cross over domains—essentially meaning that if a user visits a particular website, an attacker can open Facebook and can collect information about the user and their friends,” Masas said, according to Brinkwire.
While testing out the attack, Masas was able to determine specific data on users and their friends regardless of one’s privacy settings.
Information obtained included, among other things, whether a user had taken a photograph in a certain location or had friends of a certain religion.
“Similar queries can be composed to extract data about the user’s friends,” Masas said. “For example, by searching ‘my friends who like Imperva’ I can check if the current user has any friends who like the Imperva Facebook page.”
Masas added that the vulnerability was especially dangerous for mobile phone users, who may not even notice a new browser tab opening when the attack takes place.
In a statement to The Verge, Facebook stated that such an attack would affect other websites as well, not just its own.
“As the underlying behavior is not specific to Facebook, we’ve made recommendations to browser makers and relevant web standards groups to encourage them to take steps to prevent this type of issue from occurring in other web applications,” Facebook said.
The social media company also denied seeing any evidence that the attack was exploited prior to Masas’ discovery.
News of the bug comes amid increased scrutiny for Facebook following a string of data privacy scandals.
Facebook was recently fined $641,000 by a British watchdog over its involvement in the Cambridge Analytica scandal, which saw data on as many as 87 million Facebook users handed over to third parties.
