Published On: 02 May 2020
Adding anyone including non-friend and blocked people as co-host in personal event!
IDOR
Facebook | Web
Inclusion in the 2019 Thanks page
MEDIUM VALIDThis IDOR vulnerability in the Facebook Events platform allowed an attacker profile to add anyone as co-host in his/her personal event including non-friends, non-friends-of-friends and people who have blocked him/her.
Description
When you are creating an event from your personal profile on Facebook, Facebook would ask you to select friends who you want to add as co-hosts for the event. For this vulnerability to be reproduced, you would have to select a friend as co-host and while submitting the request to Facebook, you would have to replace his/her profile ID with the profile ID of someone who is neither your friend, nor any of your friends-of-friends (i.e. either non-friends-of-friends or blocked people).
Impact
Taking an advantage of this vulnerability, an attacker would be able to add anyone including non-friends-of-friends and blocked people (people he/she has blocked and people who have blocked him/her) as co-host in his/her personal event on Facebook.
Reproduction Steps
Step
1
Login to User A's account on the web version of Facebook, and then visit https://www.facebook.com/events/
Step
2
Click on "Create Event" and select any of the options among private and public events.
Step
3
Select User A in Event Host drop-down list (if User A has pages, it will show drop-down list, otherwise it will show User A only, so in such case, no need to worry about selecting User A as it is selected by default).
Step
4
Fill up all the fields in any way you want, and in Co-hosts field, enter "User B" and select User B.
Step
5
Before clicking on the "Create" button, start intercepting on BurpSuite or OWASP ZAP or any other similar tools.
Step
6
Click on the "Create" button, and keep forwarding all the requests until you see a request which looks like this:
POST /ajax/create/event/submit/?title=[EventName]&description=[Description]&location=...&location_id=....&location_latlong[latitude]=...&location_latlong[longitude]=...&cover_focus[x]=0.5&cover_focus[y]=0.5&only_admins_can_post=true&post_approval_required=false&co_hosts[0]=1008&start_date=11%2F25%2F2019&start_time=7200&end_date=11%2F25%2F2019&end_time=18000&timezone=........ HTTP/1.1
Here, 1008 = User ID of User B
Step
7
Replace the value of co_hosts[0] parameter with the User ID of non-friend, i.e. User C (31337), and then forward the request. Now, the event will be created.
Step
8
When you click on "1 co-host pending", you will be able to see that User C has been successfully added as co-host in the event.
Step
9
Now, login to User C's account, and you will be able to see a notification telling "User A made you a host of his/her event [EventName]."
Exceptional Case
If User C has blocked User A, then also this works without any issue, but in that case, User C won't be able to see the event because of User A being blocked, however User A will see User C in pending co-host list.
SETUP
Requirements: 1. A PC with a web browser 2. An Internet connection, and no geographical restriction on the usage of Facebook 3. Three Facebook accounts; User A, User B and User C. User A = event host = User ID is 1337 User B = User A's friend, who has no role, but will be useful when selecting a co-host for the event so that it can intercepted = User ID is 1008 User C = totally unknown person to both User A and User B, and not friend with any of them = User ID is 31337