Source: IHTeam Security Blog
In this article “Having a facebook account is not so bad if you can have a free and fast proxy!
The affected page is:
“q” parameter must be a valid unescaped URL. Output page will show you the HTML code of the URL and guess what? Request will be made by facebook server, without report your original IP. Also “x-forwarded-for” is not used (thanks to white_sheep for this check)
::ffff:22.214.171.124 – – [14/Dec/2011:00:46:01 +0100] “GET / HTTP/1.1″ 200 10222 “-” “facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)” “4.40″ “-” “-”
A potential attacker can use this kind of attack for:
■Sql Injection attack (GET requests only)
■Directory and File crawling