A malicious editor of a page can support to a community action which can’t be unsupported by the admin!

mAshraf
mAshraf
Jul 9 · 2 min read

Facebook is expanding its efforts to retain its users, with a feature called community action which allows users to initiate an idea to advocate an action which may support by other users. then the creator has to tag the community action to the associated government entity. the tag is only implemented when the number of supporters reach 5 supporters of the action. a user that interests to support an action can interact with that community action as either user or on behalf of a page. the pages has roles, at this time, only page admin and page editors can support to a community action. The two roles ( admin and editor ) may not see or agree to support a specific Community action. I mean the editor can go rogue and support an action in which admin may not be admired. so when it comes to roles, of course the admin is super power, and has the ability to refuse or abandon any activity in which he is not admired, to unsupport, in this case, to any community action supported by any page editor in that the admin is not agree to support that community action. contrary to that, there was a vulnerability in which the admin himself abandoning to unsupport to that unwanted community action.

TIMELINE :

21 Feb 2019 : Report sent

25 Feb 2019 : Escalation by Facebook

26 Feb 2019 : Sec Team sent to Product Team

04 Mar 2019 : Facebook asked to confirm patch

05 Mar 2019 : Patch Confirmation sent to Facebook

05 Mar 2019 : Bounty Awarded by Facebook

IMPACT :

a page editor can support a community action on behalf of a page, and the action cannot be unsupported even by the page admin.

Steps to Reproduce :

1. An editor of a page interacts to a community action as the page ( Facebook allows a user to interact to a community action to either as a user or page if He manages one) “
then he supports to the community action interacting on behalf of the page.

2. Then the admin of the page tries to “Unsupport” to the community action, then an error is displayed! “This Content is no longer Available!” which Implies that he can not unsupport it!

Here is a PoC Video :

More to Follow….

mAshraf

Written by

mAshraf

bug hunter, build and destroy lover :)

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade