Acknowledged by "FaceBook" Security Team
Today in Amman, Jordan
Got acknowledged by Facebook Security Team After discovering a security issues in a "portal" store "portal.faceboo..." A store dedicated to the sale of "Portal and Portal+" devices provided by Facebook recently.
The vulnerability type "IDOR": allows any potential attacker to change the account settings for another user
حصلت على أعتراف من الفريق الامني في شركه فيسبوك بعد أبلاغي عن خلل أمني متجر portal.faceboo... المخصص لبيع أجهزة الاتصال portal & portal+ التي وفرتها فيسبوك مؤخرا.
نوع الثغره "IDOR" تسمح لأي مهاجم محتمل بتغير اعدادت الحساب لاي مستخدم اخر على خدمة portal.faceboo...
PoC : • Facebook IDOR bug in G...
HOF : / thanks
Timeline:
10/10/2018 Me, Submitted Report
15/10/2018 FB, Need More Info and Sent a reply
18/10/2018 FB, Need More Info and Sent a reply
22/10/2018 FB, Reproduce my report
25/10/2018 FB, Report Triaged
07/11/2018 Me, Ask any update?
14/12/2018 Me, Ask Any Update?
25/01/2019 Me, Ask Any Update?
26/02/2019 Me, Ask Any Update?
26/02/2019 FB, Apologize to daley!!
01/03/2019 Me, ask any update?
15/04/2019 Me, ask any update?
15/04/2019 FB, Issue Fixed and confirm
29/04/2019 FB, bounty awrded
Негізгі бет Facebook IDOR bug in GraphQL
No video
Пікірлер: 76