A tale of Bug Bounties

Posts

How I could have made your products Out of Stock in Facebook Pages!

Hi, This post is regarding one of my findings in Facebook which could have allowed anyone to toggle the stock status of products created by admins of a Facebook page. Bug: Toggling the stock status of Products created by any Facebook page without having any roles on the page POC Steps Page admins can create/manage Facebook products on their page. There are options available for the admins to mark a product as "In Stock" or "Out of Stock" by sending a POST request to the endpoint "/pages/content_tab/products/update_inventory/?" This endpoint accepts the below three main parameters. av: the page id product_group_ids[]: An array of product group ids for batch update. inventory_in_stock : true or false(In Stock or Out of Stock) Security checks were missing at this endpoint which allowed me to change the stock status of any product group id. Now, to exploit this vulnerability, we need the product group id of victim's product. The pro

Leaking of page store details via downloaded location data from Business Locations

Hi, This post is regarding one of my findings in Facebook which could have allowed anyone to access details of a page's stores by exporting a CSV. Bug: Leaking of page store details via downloaded location data from Business Locations POC Steps Page Admins can download locations data from Business Locations using the link "https://business.facebook.com/ajax/editpagesx/export_children.php?id=12345&intern_tool=false" where 12345 is the page id. This will allow them to download and view the location pages and their data connected to the main page. Security checks were missing at this ajax endpoint which allowed me to download the locations data for any Facebook page by replacing the value of "id" parameter with victim's page id. There were some sensitive data like Franchise, Store Number, Store Visits Measurement,Network Access Type, Location Descriptor etc in the downloaded excel file which should be accessible only to the page admins. These de

Setting up tests for any App or Pixel using Facebook's Test and Learn feature

Hi, This post is regarding one of my findings in Facebook which could have allowed anyone to set up tests for apps/pixels to which he does not have any roles/access. Bug: Bug in Facebook's "Test And Learn" Feature which allows an attacker to set up tests for apps/pixels to which he does not have any roles/access and to view the test results. POC Steps Users can setup tests from the url https://facebook.com/test-and-learn/?act=12345 where 12345 is ad account id.(Refer https://www.facebook.com/business/help/1575448755848995) The bug was in the 2nd test option "How many conversions are all my Facebook ads causing?" Click on "Set up Test", enter a test name and select any of your apps/pixel as the event source and select the schedule. The API call to setup a test is like below. "POST /v2.10/me/ad_studies?" There were no security checks at this end point to check whether authorized user is making the request or not. In this reques

How I could have crashed the Page Role setting of any Facebook page

Hi, This is my second blog post regarding one of my findings in Facebook's Business Manager. Bug: Bug in Business Manager which allows an attacker to completely disable a page admin's access to his page's Page Roles Settings. This exploit works in the below scenario: -->Attacker has a Business Manager account --> Victim does not have any Business Manager Account(ie, victim just has some normal Facebook pages which he owns) In Business Manager, users can add new apps or request access to an app owned by other business accounts. If you want to request access to an app, you just need to enter the APP ID and click on "Request App" so that the admin can grant you the access after receiving the request. The request to a new app is created using the below graph api call with a valid access token POST /v2.10/951117391698528/sent_requests It looks for mainly two parameters :object_id and brand id object_id: The id of the app to which you n

Oauth token validation bug in Facebook

This is my first blog post. I started bug hunting on Facebook from 2016 and got listed in Facebook's Hall of Fame of 2016 and 2017 for finding various bugs. I thank all the people who supported me till here especially my best friend Shaila. I will be posting my findings/thoughts here. Bug :Validation missing in "oauth_token"("facebook.com/twitter" end point) allows an attacker to link his twitter account to victim's page even after victim removes attacker's admin role on victim's page. The end point "https://www.facebook.com/twitter/?setup=1" allows a user to link his account/page to a twitter account. To link a page to twitter account, you need to go to this url and click on the "Link to Twitter" button which will generate a url which look like "https://twitter.com/oauth/authorize?oauth_token=Z2lV-AAAAAAAADeMAAABW9-WtA8" Once the user clicks on Authorize app, the account/page selected will get linked to t