Whitehat test accounts can act as Hidden Admin with Business manager / Ad Accounts.

Rohit kumar
4 min readOct 12, 2019

--

Again this will be a copy/paste of my whole report nothing fancy gifs and memes in this report 😐

Title

Whitehat test accounts can act as Hidden Admin with Business manager / Ad Accounts.

Vuln Type

Privacy / Authorization

Product Area

Facebook — Web

Description/Impact

Description
===
Hi Facebook Team,

According to Facebook whitehat, test account is having some limitations like

1. Can interact with other test accounts, but not with real accounts
2. Are exempt from Facebook spam or fake account detection systems
3. Cannot like Facebook pages or post to a page’s Wall
4. Cannot be converted to a real user account

but, I noticed that a malicious admin can perform a lot of actions in a real business manager account and those all action will be not visible to other admins/managers which leads to different kind risk.

I was able to perform and test this vulnerability on different features like

1. Add hidden pages
2. Hidden Ad account managers
3. Hidden pages in partners business
4. Can add a hidden system user

A hidden business manager admin (Which is whitehat test account) can work on above all mentioned features and those all works will be completely hidden by other real admins.

I will reply this same thread if I will be able to perform any more task.

Impact
===
Malicious admins can add pages, give ad accounts access permission to other malicious persons, can add new partners business (with hidden pages inside those businesses) etc..

Repro steps

Setup
===
1 Whitehat test account
1 Real user account
1 Business account created by real user account

Steps
===
1. From real user account send an invite to email someone@email.com
2. Now, click on Resend email button and copy the signup link.
3. Now, from whitehat test account visit that link and join that business
4. Now, add any page from whitehat test account (which was created by you) that page is not visible to other admins.
5. Now, open ad account list and assign yourself in that an account. Other admins can’t see you are managing that ad account.
6. Add system user from a whitehat test account, other admins can’t see that system user.
7. Create another business with few pages linked from a whitehat test account.
8. Add that business to a real business account as a partner, other admins will be not able to see a list of linked pages in that business.

21 Jun

Hi Rohit,

Thank you for your submission.

We’ve managed to reproduce your report and will get back to you once we have had a chance to investigate.

Thanks,

Logan
Security

Your Reply

14 Jul

Hi Logan,

Any updates on this report?

Thanks,
Rohit Kumar

Your Reply

25 Aug

Hi Logan!

Can I get any update on this report, please?

30 Aug

Hi Rohit,

Sorry for the delay. Thank you for reporting this information to us. We are sending it to the appropriate product team for further investigation. We will keep you updated on our progress.

Regards,

Joel
Security

2 Oct

Hi Rohit,

We have looked into this issue and believe that the vulnerability has been patched. Please let us know if you believe that the patch does not resolve this issue. We will follow up regarding any bounty decisions soon.

Thanks,

Joel
Security

Your Reply

3 Oct

Hi Joel,

Yes, I believe this vulnerability has been patched!

Thanks,
Rohit Kumar

Yesterday

After reviewing this issue, we have decided to award you a bounty of $XXX. Below is an explanation of the bounty amount. Facebook fulfills its bounty awards through Bugcrowd.

Whitehat test accounts can be invited to a regular Business Manager.

Thank you again for your report. We look forward to receiving more reports from you in the future!

Having any questions? Let me know at my twitter handle @rohitcoder

--

--

Rohit kumar

✌ Hacking & Security, Programming / Technology - Not all superheroes wear capes, some just push code to Github.