Published On: 05 May 2019
Spoofing identity of user tagging someone in a video
Other
Facebook | Web
---
LOW VALIDDescription
Attacker is able to impersonate users identity when the attacker tag his friends or ( friends of friend s ) on the victim videos . A wrong notification reached the user tagged , where this notification is sent on behalf of the owner of the video ( Victim ) . This attack took place when the attacker use the Business Manager Token an d make the tag using the GRAPH API
Impact
Spoofing identity of user tagging someone in a video .
Reproduction Steps
Step
1
Step
2
Kassemthe attacker tagged his friend Sarmad on Stephen Video using a business token in theGraph API Explorer
Access Token : Business Manager Token (436761779744620 : Business Manager)
POST RequestV3.2Vide_ID/tags(Stephen Video ID102576690882894).
Parameter :tag_uid (friendID that we wants to tag himIn our test - Sarmad account ID) .
Note: Kassem(attacker) is able to tag on Stephen (victim) Video because the Video is public and Kassem and Stephen has at least 1 mutual friend
Step
3
A notification reached Sarmad that Stephen(Victim) tagged him although Kassem(Attacker) is the tagger ( the notification is sent from the wrong user *from the owner of the video * )
Attacker have the permission to tag his friends on Victim videos although there is no relationship between the victim(owner ofthe video ) and the attacker friends( friends tagged by the attacker ) .
Result
Kassem impersonate Stephen Identity where Sarmad though that Stephen who tagged him although Kassem who makes this tag
Videos