Oauth token validation bug in Facebook

This is my first blog post. I started bug hunting on Facebook from 2016 and got listed in Facebook's  Hall of Fame of 2016 and 2017 for finding various bugs. I thank all the people who supported me till here especially my best friend Shaila. I will be posting my findings/thoughts here.

Bug :Validation missing in "oauth_token"("facebook.com/twitter" end point) allows an attacker to link his twitter account to victim's page even after victim removes attacker's admin role on victim's page.

The end point "https://www.facebook.com/twitter/?setup=1" allows a user to link his account/page to a twitter account.

To link a page to twitter account, you need to go to this url and click on the "Link to Twitter" button which will generate a url which look like "https://twitter.com/oauth/authorize?oauth_token=Z2lV-AAAAAAAADeMAAABW9-WtA8"
Once the user clicks on Authorize app, the account/page selected will get linked to the twitter account.
The intersting fact here is that, Twitter OAuth doesn't implement state parameter and their tokens never expire.
To know more about OAuth and to know how it works. refer https://en.wikipedia.org/wiki/OAuth

Now, the bug scenario is like below.

• A and B are admins of a page where A is the attacker and B is the victim.
• A tries to link the page to twitter and gets the url containing oauth token(eg:https://twitter.com/oauth/authorize?oauth_token=Z2lV-AAAAAAAADeMAAABW9-WtA8)
• But A just keeps this url without using it
• B removes A's admin role from the page.
• Now A does not have admin access to the page
• As A has lost admin access to the page, A cannot link the page to any twitter account.
• But what if A can make B to link the page to A's twitter account? :P
• A opens the previously saved url and uses burpsuite and captures the return url which will look like "https://www.facebook.com/feed/export/service_landing.php?service=1&oauth_token=7rKYwgAAAAAAADeMAAABWm0_rvA&oauth_verifier=zvr1Njy9Y6y3FYC48Gu5kMA4UzCmeNe0"
• A sends this url to victim as a message or makes victim to open this url.
• When victim opens the url, victim's page will get linked to A's twitter account.

Here, An attacker was able to re-use the token even after loosing admin access to that page.
Reported this to Facebook and got a nice bounty :)





This made my name to get listed in Facebook's  Hall of Fame 2017 as well

Let me know your thoughts on this :)

POC Video

                           Vimeo link: https://vimeo.com/216341548 




Report timeline

22th February, 2017 - Bug Reported
28th February, 2017 - Asked for more clarification.
28th February, 2017 - Provided more clarification
28th February, 2017 - Arthur confirmed the bug and sent to product team.
6th March, 2017 - Issue has been resolved and asked to confirm
16th March, 2017 - Bounty awarded.