Skip to main content

Setting up tests for any App or Pixel using Facebook's Test and Learn feature


Hi,
This post is regarding one of my findings in Facebook which could have allowed anyone to set up tests for apps/pixels to which he does not have any roles/access.

Bug: Bug in Facebook's "Test And Learn" Feature which allows an attacker to set up tests for apps/pixels to which he does not have any roles/access and to view the test results.

POC Steps

Users can setup tests from the url  https://facebook.com/test-and-learn/?act=12345 where 12345 is ad account id.(Refer https://www.facebook.com/business/help/1575448755848995)
The bug was in the 2nd test option "How many conversions are all my Facebook ads causing?"
Click on "Set up Test", enter a test name and select any of your apps/pixel as the event source and select the schedule.
The API call to setup a test is like below.
"POST /v2.10/me/ad_studies?" 
There were no security checks at this end point to check whether authorized user is making the request or not.
In this request, change the value of application id/pixel id with the application id/pixel id of the victim.
Submit the request and the test will be created and status will be "planned"
Click on the test created and victim's app or pixel will be listed under measurement sources!
Now, The test will start collecting the results for the mentioned schedule for victim's app/pixel and will display the lift results and incremental efficiency associated with victim's ads.This will show how much money was spent by victim over the period and other details as well.
Just like in the below two sample figures





Mitigation and Fix

I reported this bug to Facebook on 21st January and the report was on triage by 23rd           
By 1st February, Lilly from security team updated that a permanent fix was available.       
When I tried, I got below error as well.

"Application does not have the capability to make this API call" 

As this could have allowed anyone to setup tests for victim's apps/pixels, I got a nice bounty for the same!



I am thankful to the Facebook Security team for the quick fix and for the awesome bounty :)
Report timeline

21st January, 2018 - Bug Reported
23rd January, 2018 - Lilyfrom Facebook Security confirmed the bug and sent to product team.
1st February,2018 - Was Asked for the confirmation of temporary fix and I confirmed the same.
7th February,2018- Bounty awarded. 3000 USD.

Comments

  1. sheela rajesh10 May 2019 at 21:57

    Your blog is more informative and inspirational to others.it gives wish to know more about this.
    JAVA Training in Chennai
    Java training institute in chennai
    Python Training in Chennai
    SEO training in chennai
    Big data training in chennai
    Selenium Training in Chennai
    JAVA Training in Chennai
    Java Training in Tnagar

    ReplyDelete
  2. Bella3 October 2019 at 00:27

    Informative post. Thanks for sharing.

    Stocks4all

    📌Stocks4all.com🌐 is Coming soon............🥁🥁🎊🎉
    Follow this page to get noticed when we launch the website Few days to Go......
    Like👍 & share👥 this page to get the best information on stocks...✍️💯

    ReplyDelete
  3. Blogger25 February 2020 at 04:53

    Water Hack Burns 2 lb of Fat OVERNIGHT

    Well over 160 thousand men and women are using a easy and SECRET "liquids hack" to drop 2 lbs every night as they sleep.

    It is painless and works every time.

    This is how to do it yourself:

    1) Take a clear glass and fill it up half glass

    2) Now do this strange hack

    you'll be 2 lbs lighter the very next day!

    ReplyDelete
  4. Pranav Baruwala24 April 2020 at 05:58

    Thank you for sharing valuable blog. you are doing good job.

    what is roi & kpi

    what is facebook pixel & how to create facebook pixel

    ReplyDelete

Post a Comment

Popular posts from this blog

How I could have hacked Facebook Analytics to view any Facebook page's Analytics- $7500

Hi, This post is regarding one of my findings in Facebook which could have allowed anyone to view the Facebook Analytics of any Facebook page without having any roles on the page. Bug:  Bug in Facebook Analytics which allows an attacker to view analytics of any Facebook page without having any roles on the page. POC Steps The API call to create an event source group is like below. "GET /v2.10/1234/event_source_groups?"  where "1234" is the business account id and it accepts the parameters,  name and  event_sources  . The parameter  event_sources  can contain the id of page,app,pixel or offline event set. After some testing, I found that while adding a page object as an event source, there are no security checks at this end point to check whether authorized user is making the request or not. In addition to this, I found other two end points as well which is vulnerable. 1)While making a POST request to an existing event source group. 2)A...
3 comments
Read more

Oauth token validation bug in Facebook

This is my first blog post. I started bug hunting on Facebook from 2016 and got listed in Facebook's   Hall of Fame  of 2016 and 2017 for finding various bugs. I thank all the people who supported me till here especially my best friend Shaila. I will be posting my findings/thoughts here. Bug :Validation missing in "oauth_token"("facebook.com/twitter" end point) allows an attacker to link his twitter account to victim's page even after victim removes attacker's admin role on victim's page. The end point "https://www.facebook.com/twitter/?setup=1" allows a user to link his account/page to a twitter account. To link a page to twitter account, you need to go to this url and click on the "Link to Twitter" button which will generate a url which look like "https://twitter.com/oauth/authorize?oauth_token=Z2lV-AAAAAAAADeMAAABW9-WtA8" Once the user clicks on Authorize app, the account/page selected will get linked to t...
1 comment
Read more