Facebook Bug POC - Determine any Page Admin Role

 

It was possible for an attacker to determine any Page Admin Role without any interaction

Facebook Bug POC - Determine Email Address and Phone Number of Users

By following the POC below, it was possible for a hacker to determine if a given Email Address or a Phone Number

Facebook Bug POC - CSRF renew access to Apps

It was possible for an attacker to renew access to Apps

Facebook Bug POC - Deleted/Modified User Website info

A depreciated API legacy field "website", when called out on a user node with a whitelisted access token on Graph API,

View "Facebook Language" of any Facebook User (NA)

A Facebook Open Graph Object called "locale" is a part of "Localization" on Facebook.

This object can vary from node to node when called on to the servers.

Facebook Bug POC - Deleting Friends notifications

 

Two endpoints performing an Invite and a Removal to add and remove Contributers for Collections were missing rate limiting.

Every Invite would send a notification to that Friend.

Facebook Bug POC - Missing rate limit on Device Code verification

A GraphQL call was missing rate limit on verifying login codes for devices.

Facebook for Devices - Facebook for Devices helps you use your Facebook account to access apps and services on

Facebook Bug POC - Admin discloser by "Team members" feature

During content discovery, I was redirected to a page which pushed me to old Facebook UI.

Facebook Bug POC - Group Quality Insight

Group Quality Insights - Information of what/when/why Community standards are violated in a group (Includes False News).

Who can see this info - ONLY GROUP ADMINS (Mods excluded).

Facebook Bug POC - Fetching Demographic Audience data Insight for any Page

There was a GraphQl request which could be malformed to get the Demographic Audience data insight for any Facebook Page.

Demographic Audience data insight - Country (specific in this bug)likes insight.