Modifying any Ad Space and Placement

Joshua Regio
Feb 22, 2018 · 2 min read

In early November, Facebook introduced a new feature in the Audience Network called Ad Spaces.

Description: It is possible to modify any Ad Space and Placement given the victim’s Ad Space and Placement IDs

Impact: A malicious user can modify any info of an Ad Space. A malicious user can also add and modify Placement.

Proof of Concept:
Editing Ad Space:
1. Go to “https://developers.facebook.com/apps/APP_ID/audience-network/adspaces/".
2. Create an Ad Space.
3. Edit that Ad Space.
4. Using a Debugging Tool, capture the POST request in editing the Ad Space.
5. In the POST request change the param “ad_space_id” to any Ad space ID

Adding Placement:
1. Go to “https://developers.facebook.com/apps/APP_ID/audience-network/adspaces/".
2. In your Ad Space, create a Placement.
3. Make sure to capture the POST request using a Debugging Tool.
4. In the POST request change the “ad_space_id” to any Ad Space ID

Editing Placement:
1. Go to “https://developers.facebook.com/apps/APP_ID/audience-network/adspaces/".
2. Select and Edit your Placement.
3. Make sure to capture the POST request using a proxy tool.
4. In the POST request URL change the Placement ID to your Victim’s Placement ID.

Their initial fix was to disallow any user to modify any Ad Spaces, but you could still modify Ad Spaces if you have a Tester or Analytic User role in the App.

Video POC: https://drive.google.com/drive/folders/1lkiHhJUUByXPyBu2uPpCWx3LGl5EZvNx

Timeline:
Nov. 09, 2017 — Initial Report
Nov. 14, 2017 — Report Triaged
Dec. 5, 2017 — Fixed by Facebook
Dec. 5, 2017 —Fix is insufficient
Dec. 15, 2017 — Fixed by Facebook
Dec. 15, 2017 — Fix is insufficient
Dec. 21, 2017 — Bounty awarded
Feb. 19, 2018 — Issue Resolved

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store