Published On: 21 May 2020
DoS Facebook Messenger Web(prevent chat from loading)
DoS
Messenger | Web
---
UNDEFINED VALIDDescription
In Facebook pages, admins are able to place an order for users who previously contacted the page, this order will be sent to the user through the messenger , if we intercept the request before placing the order and changing the "product_image_url" to a crafted URL the Facebook Messenger on the victim side will fail to load chat and the page will stay showing the load button while its completely down in mobile version(e.g m.facebook.com ) , However user is able to use messenger on the app.
Impact
A malicious user is able to DoS other users Messenger by prevent them from loading the messages .
Reproduction Steps
Step
1
"Kassem" opened the inbox of his page , then he select any user that is previously contacted the page (Victim who contacted the page)
Step
2
in the right side he chooses "Add Activities " - > "Place order".
Step
3
once he clicked on it , he looked at the conversation with this user , a message is appeared -"You confirmed that "username" placed an order. Send Details")
Step
4
Clicking on "Send Details" then a box is appeared to fill some information about this order , so "Kassem" filled these information and then intercepting the request and placing the order.
Step
5
"Kassem" changed the parameter "product_image_url" to a crafted URL
While I'm testing I added a website after the last parameter (oe= ), I was trying to see if is there is any excution for any link (e.g ip disclosure) but I was suprised that the messenger is not able to load the chat and in m.facebook.com is completaly down.
so adding a websites to the end of the url from (scontent.fbey) will result to fail loading messages on Facebook Messenger.
This is the error returned while fetching the chats
Errors while executing operation \"MessengerThreads\": At Query.message_thread:MessageThread.messages:MessagesOfThreadConnection.nodes[1]:UserMessage.extensible_attachment:ExtensibleMessageAttachment.story_attachment:StoryAttachment.media: Field implementation threw an exception. Check your server logs for more information.
Step
6
and if you browse your inbox through m.facebook it will show an error
"Sorry, something went wrong "
Thanks
I would like to thanks my friend Abdallah Yaala who helps me while testing this bug .
Videos
