Authentication Bypass Leads to Unauthorized Data Access for Linked Facebook, Instagram, and Meta Accounts ($5000 Bounty)

Vulnerability Report

Hello,

Today, I'm sharing a vulnerability I discovered in Meta's bug bounty program. This vulnerability allows attackers to gain unauthorized access to victims' account data, affecting Meta's primary technologies (Facebook, Instagram, and Meta accounts).

To understand this bug, it's essential to grasp what is the Account Center.

The Account Center, provided by Meta, offers users a unified interface to manage and integrate their experiences across Facebook, Instagram, and other Meta services. It centralizes settings, permissions, and account data management, streamlining the handling of multiple linked accounts under the Meta umbrella. For more information about the Account Center, you can visit here.

Sensitive Data Transfer Feature

One of the features of Account Center is the ability to download or transfer the data of your accounts, including those of other linked accounts. This data is extremely sensitive and can include:

Personal messages
Photos and videos
Friends and followers lists
Login and session data
Payment information

Given the sensitivity of this data, robust security measures are expected to be in place to protect it from unauthorized access.

Exploiting the Vulnerability: Unauthorized Data Transfer

I assumed the scenario of gaining access to a victim's Facebook account, which is linked with Instagram and Meta accounts. I then attempted to access the data of these other linked accounts.

I navigated to the Account Center data download page.
Attempting to download the data of the linked Instagram and Meta accounts, I was prompted for the passwords of these accounts.
Initially, I entered the correct password and captured the successful response.
Subsequently, I tried again, entering incorrect passwords and manipulating the response with the previously captured successful response. This method did not work for direct downloads.

However, there was an option to transfer the data to cloud services like Google Drive or Dropbox. I exploited this feature:

I initiated the data transfer and was prompted for the passwords of the linked Instagram and Meta accounts.
I entered incorrect passwords, intercepted the request, and manipulated the response with the previously captured successful response.

And just like that, the transfer started, and I received all the victim's Instagram and Meta account data in my drive without knowing the passwords for those accounts.

This bug also works across other platforms. For instance, if an attacker gains access to a victim's Instagram account, they can transfer the data of linked Facebook and Meta accounts. Similarly, if an attacker gains access to a victim's Meta account, they can transfer the data of linked Facebook and Instagram accounts.

Steps to Reproduce

Victim's Side:

The victim has connected Instagram, Facebook, and Meta accounts.

Attacker's Side:

The attacker gains access to the victim's Facebook account.
The attacker navigates to Account Center data download page.
The attacker initiates a transfer of all the victim's account information to their Google Drive.
The system prompts for the Instagram and Meta passwords.
The attacker enters any random password and intercepts the request.

The attacker replaces the response body with:

{"data":{"fxcal_reauth_v2":{"success":true,"error_data":null,"error_state":null}},"extensions":{"is_final":true}}

The transfer starts, and the attacker waits for it to finish.
The attacker opens their drive and finds they have received all the victim's account data.

Proof of Concept Video

For a detailed demonstration, refer to the POC video here.

Impact

This vulnerability allows an attacker to gain unauthorized access to sensitive user data from linked Facebook, Instagram, and Meta accounts. By exploiting this flaw, an attacker can bypass the security mechanisms meant to protect this data, leading to potential privacy breaches and misuse of personal information.

Moaz Adel

Search This Blog