(Security Affairs – Facebook, hacking)
Pierluigi Paganini
August 29, 2015
The security expert Laxman Muthiyah from India has discovered a new vulnerability in the popular social network Facebook. This is the third bug discovered by the expert in since January, at the beginning of the year he found a serious flaw in Facebook graphs that allowed him to delete users’ Facebook photo album without being authenticated.
A few weeks later he announced the discovery of a new critical flaw affecting the Facebook Photo Sync feature, a feature that allows the automatic uploads of photos from user’s mobile device to a private Facebook album, which is not visible to Facebook friends neither to other Facebook users.
The flaw discovered by Laxman could allowed any third-party app to access user’s personal photographs from the hidden Facebook Photo Sync album,
This time the expert discovered a way to hack any Facebook Page, the vulnerability affects the “Facebook business pages” which are related to businesses and organizations. These pages are usually managed by a number of users, Laxman could allow third-party apps to take complete control of a Facebook business page with limited permissions, possibly making the victim permanently lose administrator access to the page.
Laxman Muthiyah explained that third party Facebook applications can perform a number of actions, including post photos and status update on user behalf. However, Facebook doesn’t allow them to add or modify page admin roles.
The popular social network allows administrators of business pages to assign different roles to different users through manage_pages, an access permission requested by third-party apps.
The expert discovered that an attacker can use a simple string of requests to impersonate the admin of a Facebook page, below and example of string:
POST /PGID/userpermissions HTTP/1.1Host: graph.facebook.comContent-Length: 245role=MANAGER&user=X&business=B&access_token=AAAA…
The page PGID if used to identify the business associated to the page, the manage_pages request allows to assign the role of MANAGER to the user ‘X’ which allow the attacker to take over the Facebook business page.The expert also provided a video PoC for the exploitation of the flaw:
