<story><title>We recently awarded our biggest bug bounty payout</title><url>https://www.facebook.com/BugBounty/posts/778897822124446?stream_ref=10</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>XXE&amp;#x27;s are awful. You wouldn&amp;#x27;t think that simply by parsing an XML file --- something so simple people are tempted to do it with regexes --- you&amp;#x27;d be invoking machinery that translates the XML language and binds it to, in effect, scripting language features. But that&amp;#x27;s what you&amp;#x27;re doing when you use common XML libraries!&lt;p&gt;For applications on mainstream stacks, if you accept XML inputs (explicitly accept them, that is; as in, invoke the XML parser yourself) and haven&amp;#x27;t taken the time to make sure you&amp;#x27;re not expanding entities, the safest bet is to assume that your XML parser has a &amp;quot;let inbound XML run shell commands&amp;quot; feature embedded into it. That&amp;#x27;s an oversimplification, but maybe not much of one.&lt;p&gt;This is a great, subtle finding. And Reginaldo handled it like a pro. Let the feeding frenzy for hiring Reginaldo Silva... commence! :)</text></comment>
<story><title>We recently awarded our biggest bug bounty payout</title><url>https://www.facebook.com/BugBounty/posts/778897822124446?stream_ref=10</url></story><parent_chain></parent_chain><comment><author>reginaldo</author><text>Hi HN, I&amp;#x27;m the one who found the bug. My writeup is at &lt;a href=&quot;http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.ubercomp.com&amp;#x2F;posts&amp;#x2F;2014-01-16_facebook_remote_cod...&lt;/a&gt;. I&amp;#x27;d be glad to answer any questions. I won&amp;#x27;t disclose the amount for now because I want to know what people think this would be worth, but eventually it will be disclosed. If you run an OpenID-enabled server now it&amp;#x27;s a great time to make sure your implementation is patched.</text></comment>