Published On: 17 May 2019
De-anonymizing Facebook Employee Who Created Crisis Fundraiser
Privacy/Authentication
Facebook | Web
---
LOW VALIDDescription
It is possible for a malicious user to see who created the Crisis fundraiser. This type of fundraiser are created internally by a Facebook employee.
Impact
This could have allowed malicious user to see who created the Crisis fundraiser which in some cases is a Facebook employee.
Reproduction Steps
Step
1
Go to Crisis Response (https://www.facebook.com/crisisresponse)
Step
2
Find a Crisis with a Donate button and copy the link of the button.
Step
3
The link contains a campaign_id which is the ID of the fundraiser. Take note of this ID.
Step
4
Make the following graphql request.
POST /graphql
q = nodes([fundraiserID]){owner{name,id}}
Step
5
You will see the Facebook name and userid of the facebook employee who created the fundraiser.