Thursday, June 10, 2021

Facebook Bug POC - Deleted/Modified User Website info

A depreciated API legacy field "website", when called out on a user node with a whitelisted access token on Graph API, was returning information which was modified or deleted by that user.


The call went to -

GET /v10.0/target_user_ID?access_token=FB4A_access_token&fields=website HTTP/1.1
Host: graph.facebook.com

The response would be something like -

{
"website": "http://hackingmonks.net/",
"id": "target_user_ID"
}


When a user modifies or deletes the info from his profile, the call needed at least 10 to 15 ish days to return the data (from my tastings).


Timeline -

Reported - Friday, 9 April 2021 at 2:52 pm

While reporting I had sent my FB user ID which had Profile Lock ON and some other effected account ID's.

Reproduced by FB team - Monday, 12 April 2021 at 4:24 pm

Facebook asked more info - Tuesday, 13 April 2021 at 4:49 pm

Info sent - Tuesday, 13 April 2021 at 4:56 pm

Triaged - Tuesday, 13 April 2021 at 6:03 pm

Patched and my confirmation - Monday, 24 May 2021 at 3:58 pm

Rewarded - Friday, 4 June 2021 at 11:19 am



Bounty and explanation -