Monday, February 8, 2016

Overwriting/Removing Cover Photos on Facebook Event Pages

This blog post is about an Insecure Direct Object Reference vulnerability in Facebook Events which an attacker could have remove/overwrite your Event Cover Photo just by replacing his Event id with yours in Event editing request.



Vulnerability Description

Insecure Direct Object References occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources in the system directly, for example database records or files. 
Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system, and more. This is caused by the fact that the application takes user supplied input and uses it to retrieve an object without performing sufficient authorization checks. Reference: OWASP

Steps to Reproduce


1. Create an Event, right click edit and inspect element


2. Change the event_id's values to victim's Event id so attacker can request to edit victim's Event


3. To Overwrite, upload new photo then save
4. To Remove, click the "x" then save

Attacker successfully removed the cover photo without victim's knowledge 



as well as overwrite the cover photo 

FIX

Now, you can only overwrite/remove your own cover.






Disclosure Timeline


Jan 11, 2016 - Report Sent
Jan 13, 2016 - Escalation by Facebook
Jan 14, 2016 - Patched by Facebook
Jan 20, 2016 - Bounty Awarded by Facebook

248 comments:

  1. congrats sir, 5 years na kayo nasa whitehat list haha

    ReplyDelete
  2. Congrats po at salamat sa pag share! :-) isa kang alamat!

    ReplyDelete
  3. Imba ka gudman Mr. Roy Totdoe daw kami didi mga taga Calbayog Samar hehe God Bless po

    ReplyDelete
  4. Appaustic is an app development company helping start ups, enterprises in effective interaction with their clients. We are developing smart apps for iOS and Android. We have experts for facebook app development too.

    ReplyDelete
  5. I really enjoyed this posting in which you share a valuable post. Thanks for sharing it.
    Facebook app development company

    ReplyDelete
  6. Do you need free Twitter Followers?
    Did you know you can get them AUTOMATICALLY & ABSOLUTELY FOR FREE by getting an account on Like 4 Like?

    ReplyDelete
  7. This comment has been removed by the author.

    ReplyDelete
  8. This comment has been removed by the author.

    ReplyDelete
  9. Inspiring writings and I greatly admired what you have to say , I hope you continue to provide new ideas for us all and greetings success always for you..Keep update more information..

    rpa training in Chennai | best rpa training in chennai

    rpa training in pune

    rpa online training | rpa training in bangalore

    ReplyDelete
  10. Hi, Great.. Tutorial is just awesome..It is really helpful for a newbie like me.. I am a regular follower of your blog. Really very informative post you shared here. Kindly keep blogging.
    Data Science training in Chennai | Data science training in bangalore
    Data science training in pune| Data science online training
    Python training in Kalyan nagar

    ReplyDelete
  11. You’ve written a really great article here. Your writing style makes this material easy to understand.. I agree with some of the many points you have made. Thank you for this is real thought-provoking content
    java training in jayanagar | java training in electronic city

    java training in chennai | java training in USA

    ReplyDelete
  12. Thanks for the informative article. This is one of the best resources I have found in quite some time. Nicely written and great info. I really cannot thank you enough for sharing.
    python training in velachery
    python training institute in chennai

    ReplyDelete
  13. This is most informative and also this post most user friendly and super navigation to all posts... Thank you so much for giving this information to me.. 

    best rpa training in chennai | rpa online training |
    rpa training in chennai |
    rpa training in bangalore
    rpa training in pune

    ReplyDelete
  14. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.
    Devops training in sholinganallur
    Devops training in velachery
    Devops training in annanagar
    Devops training in tambaram

    ReplyDelete
  15. The blog you had post is verymuch useful for us to know about the Web designing. thanks for your information sharing with us.
    Web Designing Institute in Coimbatore
    Web Designing Course
    Web Design Classes
    Website Design Course
    Learning Web Design

    ReplyDelete
  16. Your information's are very much helpful for me to clarify my doubts.
    keep update more information's in future.
    Java Institutes in bangalore
    Java Institute in T nagar
    Java Training in Sholinganallur

    ReplyDelete
  17. Your information is really awesome as well as it is very excellent and i got more interesting information from your blog.
    web designing classes in pune
    graphic design classes in pune
    UI design classes in pune

    ReplyDelete
  18. Nice blog..! I really loved reading through this article. Thanks for sharing such a amazing post with us and keep blogging... best angularjs training institute in chennai | angularjs training in omr | angularjs training in chennai | angularjs training in velachery |

    ReplyDelete
  19. Thank you for your post. This is superb information. It is amazing and great to visit your site.
    Primavera Training in Noida

    Primavera Training institute in Noida

    ReplyDelete
  20. It is a great post. Keep sharing such kind of useful information.

    Article submission sites
    Guest posting sites

    ReplyDelete
  21. Very useful assistance in this particular article! It's the net worth gucci mane small improvements that make net worth eminem the greatest changes. net beyonce Thanks for discussing! net adam sandler This article net jerry seinfeld you've discussed here very awesome. I really like and appreciated your work. I study deeply your net kevin hart report, the items you have stated in this information are net triple h helpful net john cena I have never had a picked radish or green vegetable that I'm aware of - but following seeing these net david bowielovely pictures, net julia louis dreyfus I know I want to!

    ReplyDelete
  22. Nice post. Thanks for sharing! I want people to know just how good this information is in your article. It’s interesting content and Great work.
    Thanks & Regards,
    VRIT Professionals,
    No.1 Leading Web Designing Training Institute In Chennai.

    And also those who are looking for
    Web Designing Training Institute in Chennai
    SEO Training Institute in Chennai
    Photoshop Training Institute in Chennai
    PHP & Mysql Training Institute in Chennai
    Android Training Institute in Chennai

    ReplyDelete
  23. Nice and good post. This is a wonderful article, Given so much info in it, keep sharing.

    Data Science Courses in Bangalore

    ReplyDelete
  24. Its as if you had a great grasp on the subject matter, but you forgot to include your readers. Perhaps you should think about this from more than one angle.
    data science courses training
    data analytics certification courses in Bangalore
    ExcelR Data science courses in Bangalore

    ReplyDelete
  25. You know your projects stand out of the herd. There is something special about them. It seems to me all of them are really brilliant!
    data analytics course malaysia

    ReplyDelete
  26. Hi buddies, it is great written piece entirely defined, continue the good work constantly.
    Data Science Course in Pune

    ReplyDelete
  27. I really enjoy simply reading all of your weblogs. Simply wanted to inform you that you have people like me who appreciate your work. Definitely a great post. Hats off to you! The information that you have provided is very helpful.




    BIG DATA COURSE MALAYSIA

    ReplyDelete
  28. I really enjoy simply reading all of your weblogs. Simply wanted to inform you that you have people like me who appreciate your work. Definitely a great post. Hats off to you! The information that you have provided is very helpful.







    BIG DATA COURSE MALAYSIA

    ReplyDelete
  29. Excellent Blog! I would like to thank for the efforts you have made in writing this post. I am hoping the same best work from you in the future as well. I wanted to thank you for this websites! Thanks for sharing. Great websites!digital marketing course in singapore

    ReplyDelete
  30. This entire post absolutely ROCKS! Thank you for all the hard work you put into it. It really shows. Click for more, Click for more, Click for solution, Click for solution, Click for solution.

    ReplyDelete
  31. After reading your article I was amazed. I know that you explain it very well. And I hope that other readers will also experience how I feel after reading your article.
    seo certification course

    ReplyDelete
  32. Your blog was absolutely fantastic! Great deal of great information & this can be useful some or maybe the other way. Keep updating your blog,anticipating to get more detailed contents.

    Did you now number one online casino:
    sbobet
    เอสบีโอเบท
    sbobetมือถือ
    sbobetthai

    ReplyDelete
  33. This is the exact information I am been searching for
    Products24
    Really useful information. Thank you so much for sharing.
    Green KineMaster

    ReplyDelete
  34. This is a very great post and the way you express your all post details that is too good. thanks for sharing- wpgroup , 9xMovie , TamilMV , Jio Rockers , movieswood , 9xRockers , Full Form .

    ReplyDelete
  35. Hi,
    Good job & thank you very much for the new information, i learned something new. Very well written. It was sooo good to read and usefull to improve knowledge. Who want to learn this information most helpful. One who wanted to learn this technology IT employees will always suggest you take hadoop training in bangalore. Because data science course in pune is one of the best that one can do while choosing the course.

    ReplyDelete
  36. I Got Job in my dream company with decent 12 Lacks Per Annum salary, I have learned this world most demanding course out there in the current IT Market from the Hkbk group of institutions experts who helped me a lot to achieve my dreams comes true. Really worth trying

    ReplyDelete
  37. So today I thought why should you make people aware of all things about Moviescounter Bollywood, which makes it particularly dangerous as well.

    ReplyDelete
  38. Hi, yup this post is really good and I have learned lot of things from it about blogging.
    thanks.
    sbobet88

    ReplyDelete
  39. Thanks for sharing such posts with us. This is really very interesting topic for your readers to grab more knowledge about it. For more updates on Online Shopping Coupons , please visit.

    ReplyDelete
  40. They therefore incentivize their customers to play more often, by giving them rewards.
    agen joker777 mobile terpercaya
    Most venues provide their customers with player cards.
    game slot online osg777 android

    ReplyDelete
  41. Awesome..I read this post so nice and very imformative information...thanks for sharing Awesome..I read this post so nice and very imformative information...thanks for sharing
    Click here for data science course
    Click here for data science course

    ReplyDelete
  42. Great Article. Thank you for sharing! Really an awesome post for every one.

    IEEE Final Year projects Project Centers in Chennai are consistently sought after. Final Year Students Projects take a shot at them to improve their aptitudes, while specialists like the enjoyment in interfering with innovation. For experts, it's an alternate ball game through and through. Smaller than expected IEEE Final Year project centers ground for all fragments of CSE & IT engineers hoping to assemble. Final Year Project Domains for IT It gives you tips and rules that is progressively critical to consider while choosing any final year project point.

    JavaScript Training in Chennai

    JavaScript Training in Chennai


    ReplyDelete
  43. Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.
    data science course

    ReplyDelete
  44. Such an exceptionally valuable article. Extremely intriguing to peruse this article. I might want to thank you for the endeavors you had made for
    composing this amazing article.


    WordPress Bundle,
    WordPress Bundle Pack,
    WordPress Starter Pack,
    WP Starter Pack,
    WP Bundle Pack,
    Giant Brand Solutions,
    Premium WordPress Themes and Plugins,
    WordPress Themes,
    WordPress Plugins,

    ReplyDelete
  45. Thanks for every other magnificent post. Where else may anybody get that kind of information in such a perfect method of
    writing? I have a presentation subsequent week, and I’m at the search for such information.

    Visit Giant Brand Solutions
    wordpress bundle
    wordpress themes and plugins
    premium wordpress themes and plugins
    wp starter pack
    wordpress theme update
    wordpress update plugins
    wordpress website themes
    worpdress theme sites
    wordpressbundle
    wpstarterpack

    ReplyDelete
  46. Thanks for sharing your innovative ideas to our vision. I have read your blog and I gathered some new information through your blog. Your blog is really very informative and unique. Keep posting like this. Awaiting for your further update.If you are looking for any Hadoop related information, please visit our website Hadoop training institute in bangalore

    ReplyDelete
  47. Truly, this article is really one of the very best in the history of articles. I am a antique ’Article’ collector and I sometimes read some new articles if I find them interesting. And I found this one pretty fascinating and it should go into my collection. Very good work!
    data analytics course in bangalore
    data science interview questions

    ReplyDelete
  48. I am really enjoying reading your well written articles. It looks like you spend a lot of effort and time on your blog. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work.
    ai training in bangalore
    Machine Learning Training in Bangalore

    ReplyDelete

  49. Class College Education training Beauty teaching university academy lesson teacher master student spa manager skin care learn eyelash extensions tattoo spray

    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet

    ReplyDelete
  50. I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
    data analytics course mumbai

    data science interview questions

    business analytics courses

    data science course in mumbai

    ReplyDelete
  51. You actually make it look so easy with your performance but I find this matter to be actually something which I think I would never comprehend. It seems too complicated and extremely broad for me. I'm looking forward for your next post, I’ll try to get the hang of it!
    machine learning courses in mumbai

    ReplyDelete
  52. Attend The Data Science Courses From ExcelR. Practical Data Science Courses Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Science Courses.
    ExcelR Data Science Courses
    Data Science Interview Questions
    ExcelR Business Analytics Course

    ReplyDelete
  53. I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.

    data analytics courses

    data science interview questions

    business analytics courses

    data science course in mumbai

    ReplyDelete
  54. Nice blog,I understood the topic very clearly,And want to study more like this.
    Data Scientist Course

    ReplyDelete
  55. I understood the topic very clearly,And want to study more like this.
    Whatsapp group links

    ReplyDelete
  56. I just got to this amazing site not long ago. I was actually captured with the piece of resources you have got here. Big thumbs up for making such wonderful blog page!. artificial intelligence course in Bangalore

    ReplyDelete
  57. This is a wonderful article, Given so much info in it, Thanks for sharing. CodeGnan offers courses in new technologies and makes sure students understand the flow of work from each and every perspective in a Real-Time environmen python training in vijayawada. , data scince training in vijayawada . , java training in vijayawada. ,

    ReplyDelete
  58. Great blog !It is best institute.Top Training institute In chennai
    http://chennaitraining.in/openspan-training-in-chennai/
    http://chennaitraining.in/uipath-training-in-chennai/
    http://chennaitraining.in/automation-anywhere-training-in-chennai/
    http://chennaitraining.in/microsoft-azure-training-in-chennai/
    http://chennaitraining.in/workday-training-in-chennai/
    http://chennaitraining.in/vmware-training-in-chennai/

    ReplyDelete
  59. Cool stuff you have and you keep overhaul every one of us.
    digital marketing course pune

    ReplyDelete
  60. It is amazing and wonderful to visit your site.Thanks for sharing this information,this is useful to me...
    http://chennaitraining.in/bi-bw-training-in-chennai/
    http://chennaitraining.in/solidworks-training-in-chennai/
    http://chennaitraining.in/autocad-training-in-chennai/
    http://chennaitraining.in/ansys-training-in-chennai/
    http://chennaitraining.in/revit-architecture-training-in-chennai/
    http://chennaitraining.in/primavera-training-in-chennai/

    ReplyDelete
  61. Very nice job... Thanks for sharing this amazing ExcelR Machine Learning Course and educative blog post!

    ReplyDelete
  62. Attend The Data Science Courses From ExcelR. Practical Data Science Courses Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Science Courses.
    Data Science Courses
    Data Science Interview Questions

    ReplyDelete
  63. wonderful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. This article resolved my all queries.
    Data science Interview Questions

    ReplyDelete
  64. wonderful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. This article resolved my all queries.
    Data science Interview Questions
    Data Science Course

    ReplyDelete
  65. ยินดีต้อนรับสู่ g-win88.com เกมคาสิโนออนไลน์อันดับ 1 ที่ดีที่สุดในประเทศไทยและเอเชีย!

    ⮚ รับโบนัสฟรี 100% สำหรับสมาชิกใหม่
    ⮚ โปรโมชั่น แทงบอลออนไลน์ รับค่าคอม x3
    ⮚ โปรโมชั่น ลูกค่าบาคาร่า รับคืนยอดเสีย ฟรีๆ 10%

    ฝาก-ถอน โอนไว 24 ชั่วโมง⏰, ได้เงินชัว ไม่มีโกง 💯%, โปรโมชั่นดีดีไม่เหมือนที่อื่นแน่นอน

    ╔══════════════════╗
    ♛สมัครวันนี้เลย ADD LINE : https://lin.ee/1ZdZara
    ☎️Call Center บริการตลอด 24 ชม. 0929553889
    💋💋รับสิทธิ์ ฟรี!! จำนวนจำกัด💋💋
    ╚══════════════════╝

    ReplyDelete

  66. I am very happy when read this blog post because blog post written in good manner and write on good topic. Thanks for sharing valuable information.

    Java training in chennai | Java training in annanagar | Java training in omr | Java training in porur | Java training in tambaram | Java training in velachery

    ReplyDelete
  67. keep up the good work. this is an Ossam post. This is to helpful, i have read here all post. i am impressed. thank you. this is our machine learning courses
    machine learning courses | https://www.excelr.com/machine-learning-course-training-in-mumbai

    ReplyDelete
  68. I think this is a really good article. You make this information interesting and engaging. ExcelR Data Analytics Courses You give readers a lot to think about and I appreciate that kind of writing.

    ReplyDelete
  69. wonderful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. This article resolved my all queries. keep it up.
    data analytics course in Bangalore

    ReplyDelete
  70. There are many aspects of this article on which I concur with you. You have generated synapses in my brain not used often. Thank you for getting my neurons jumping.
    Best Data Science training in Mumbai

    Data Science training in Mumbai

    ReplyDelete
  71. Pretty article! I found some useful information in your blog....

    so here we provide,

    We provide you with flexible services and complete hybrid network solutions. It can provide your organisation with exceptional data speeds, advanced external security protection, and high-resilience by leveraging the latest SD-WAN and networking technologies to monitor, manage and strengthening your organisation’s existing network devices.

    https://www.quadsel.in/networking/>
    https://twitter.com/quadsel/
    https://www.linkedin.com/company/quadsel-systems-private-limited/
    https://www.facebook.com/quadselsystems/

    #quadsel #network #security #technologies #managedservices #Infrastructure #Networking #OnsiteResources #ServiceDeskSupport #StorageServices #WarrantyAMCServices #datacentersolutions #DataCenterBuild #EWaste #InfraConsolidation #DisasterRecovery #NetworkingServices #ImagingServices #MPS #Consulting #WANOptimisation #enduserservices

    ReplyDelete
  72. wonderful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. This article resolved my all queries. keep it up.
    data analytics course in Bangalore

    ReplyDelete
  73. Know more about Data Analytics
    Cool stuff you have, and you keep overhaul every one of us.

    ReplyDelete
  74. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. This article inspried me to read more. keep it up.
    Correlation vs Covariance

    ReplyDelete
  75. What a great article!. I am bookmarking it to read it over again after work. It seems like a very interesting topic to write about.
    SAP training in Kolkata
    Best SAP training in Kolkata
    SAP training institute in Kolkata

    ReplyDelete
  76. More Info of Machine Learning wow, great, I was wondering how to cure acne naturally. and found your site by google, learned a lot, now I am a bit clear. I’ve bookmarked your site. keep us updated.

    ReplyDelete
  77. Hi, I'm James Harrison a 23-year-old student who enjoys social card games, watching sport, and going to the movies. I consider myself pretty smart, but can also I can be very lazy and a bit selfish. So now I'm working as SEO, SEA, SMM freelancer. I am currently studying at Technische Universität München (TUM). I'm very experienced in copywriting, especially related to essay writing services.
    Some examples of my articles:
    ▬ How to Write an Essay Introduction
    ▬ Keeping Track of Your Research
    ▬ Paraphrasing: How to Do It Right
    ▬ Rules for Using Tables and Figures
    ▬ Research paper help: getting the right sources
    ▬ Writing a Speech: Useful Tips to Consider
    ▬ Research Paper Outline: Student's Guide
    And visit my site:
    CLICK HERE
    CLICK HERE
    CLICK HERE

    ReplyDelete
  78. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. This article inspired me to read more. keep it up.
    Correlation vs Covariance
    Simple linear regression

    ReplyDelete