[$538] IDOR allows friends to edit the date on their friends' timeline posts on Facebook

The vulnerability described here is an Insecure Direct Object References (IDOR) issue within Facebook's platform. This flaw allows a user to manipulate certain parameters in HTTP requests to edit the creation date of posts on their friends' timelines, provided they are mutual friends.

Key Points:

1. Vulnerability Details:

   • The vulnerability lies in how Facebook handles story IDs and backdating functionality.
   • By manipulating specific request parameters, a user can change the timestamp of another user's post if they have permission to view it (i.e., they are friends).

2. Steps to Exploit:

   • Identify a mutual friend on your timeline who has posted something recently.
   • Use Facebook’s Graph API or similar tools to capture the story ID and other relevant parameters.
   • Craft an HTTP request with the manipulated parameters, specifically targeting the story_id and backdating information.
   • Send this crafted request to the server. If successful, you will receive a 200 OK response.
   • Refresh your Facebook timeline in the browser to see that the post's creation date has been altered.

Technical Breakdown:

• Story ID: This is a unique identifier for each post on Facebook. By

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.