Published On: 09 May 2019
Using a premium Workplace Account (Admin panel), we are able to send a customized SMS to any phone number and with no rate limits. Note: the SMS is 100% sent from Facebook Server and no other third part or script are used .
This could have allowed a malicious user to spam SMS messages to arbitrary users and potentially phish users and increase cost to the company.
Step
1
Step
2
Step
3
Step
4
we have added a new user and status should be“invited” so choose the “three point” and send a claim notification option
Step
5
Step
6
Step
7
This is to send an email instruction but wehave to do some trick to send an SMS instead ofemail (SMSoption is not showing in the UI ).Type anything in the message(this message will noti ncluded in our SMS)then Intercept the request and tap “send button
Step
8
change the value SMS to TRUE,this is to tell the server to send anSMSto the phone number of the victim
POST /atwork/async/send_confirmation_all/?dpr=1.5 HTTP/1.1Host: workplace.facebook.comConnection: closeContent-Length: 576
email_custom_text=anything&email=false&sms=true&unclaimed_within_department&unclaimed_for_manager&users_to_send&__user=100028254561229&__a=1&__dyn=5V8WXxa-cxp2u6aJei9FxqewRyWzEsheC267Uqzob4q6oF1q13wFw_x-ewSxumeK7EiwhUlwxz8S2S4okw-Dwxxu1PyoiyEqx60xU5SF82Nxi13wDw-CK6ooxu3a1lwRyUvy88E6W78jG48423648y4Ehyo8K2y6-3CcGEbo8lCwo87e7ouzHAye1iyEiwTxe3-2i&__req=cp&__be=1&__pc=PHASED%3ADEFAULT&__rev=4282274&fb_dtsg=AQGyUiM0WegT%3AAQEhjeNz_z9i&jazoest=2658171121851057748871011038458658169104106101781229512257105&__cid=262318221066636&__spin_r=4282274&__spin_b=trunk&__spin_t=1536195578
Step
9
The result: a messageis received fromFacebook with this form
[company name ] has set up workplace for you
What if we change the company name to our message?
Step
10
Going back to the Admin Panel,and go the “preferences“, I Noticed that we are able to put a strange company name with more than 30 characters ( including a link ) so we can type a good message in the company name so we will use the“company name”as our message :D note that no limits for how many times we change the “ company name “
Step
11
Step
12
Step
13