One Flaw Allowed Hackers to Take Over Any Facebook Page

A security researcher earned $xvi,000 from Facebook subsequently discovering a serious vulnerability. If known, hackers could accept exploited this flaw to hijack any Facebook page.

Facebook Pages are at present used by every small and big organization, celebrities and even publications. Facebook's complimentary tool known as Facebook Business concern Manager allows page owners to manage advertizing accounts, apps, pages, and people who work on these pages. Business organisation Manager allows people to access their organization's Pages and ads without sharing login information.

Identified by Arun Sureshkumar, the flaw affected Facebook Business Director. If exploited, anyone could have added whatever Facebook Page to their Facebook Business Director account with Manager rights. They could have deleted the folio, inverse information technology, or shared whatever they wanted using the forum.

How hackers could have hijacked any Facebook Folio

When you lot assign someone to your page using Business concern manager, Facebook asks you lot to specify the partner's business ID and their function. During this process, good discovered that several parameters could have been manipulated thanks to an Insecure Straight Object Reference (IDOR) vulnerability.

To exploit this vulnerability, the assaulter would intercept the HTTP request their browser sent to Facebook when assigning someone equally a partner. Using IDOR vulnerability, an assaulter could have and so manipulated the parameters of the intercepted HTTP request. Replacing any page'south ID into this intercepted HTTP request, hackers could have hijacked any Facebook folio they'd have wanted.

Sureshkumar claims that hackers could hack into any page using this vulnerability, even the high-contour ones. The white chapeau hacker reported the vulnerability to social media giant on Baronial 29. Facebook fixed it within 6 hours of being notified. The company paid him a higher amount of $16,000 in bug bounty because it discovered some other issue while investigating IDOR flaw.

Post-obit is the proof of concept video that he has shared. More technical details can be plant in this blog mail service.