Facebook account takeover: Researcher scoops $40k bug bounty for chained exploit

Emma Woollacott 18 May 2022 at 11:11 UTC

Youssef Sammouda returns with more Facebook hacks – this time leveraging stolen Google authentication tokens to gain access to social media accounts

Meta has fixed a series of bugs that could have allowed a malicious actor to take over a user’s Facebook account, paying their finder a $44,625 bug bounty.

Security researcher Youssef Sammouda was able to hijack the accounts of Facebook users who signed up using a Gmail account and use a Gmail OAuth id_token/code to log in to the site.

And, he tells The Daily Swig, the same technique could have been used any other account: “Due to the complexity of developing such an exploit to do exactly that, I only submitted the exploit for the scenario that resulted in taking over Facebook accounts that authenticated with Google,” he says.

Chained exploit

The Facebook exploit leveraged a series of vulnerabilities, including a Logout CSRF bug allowing an attacker to force a victim to log out from their Facebook account in their browser and a Login CSRF bug allowing login to the attacker’s Facebook account inside the victim’s browser.

Meanwhile, a vulnerability in Facebook’s Checkpoint tool in allowed leaking any visited URL under Facebook.com to the Sandbox Domain; and, finally, an XSS vulnerability in the Facebook Sandbox Domain allowed the attacker to execute Javascript code in the context of the Sandbox Domain.

Chaining these allowed Sammouda to take over the accounts.

“We log out the user from their Facebook account, we force the login to the attacker’s Facebook account,” he explained

RELATED Fresh flaws in Facebook Canvas earn bug bounty hunter a second payday

“At this point, the attacker’s Facebook account is stuck at the Checkpoint tool; we redirect to Google OAuth which eventually redirects us to Facebook.com with a special token and code.

The researcher added: “Facebook.com leaks the token and code to the sandbox domain and we finally exploit the XSS bug to steal the token and code from the sandbox domain.”

Coordinated disclosure

Sammouda says the reporting process was efficient and straightforward: he reported the bugs to Meta on February 16, with the company fixing the issues on March 21. He received his payout on May 14.

This isn’t Sammouda’s first bumper bounty. Indeed, he’s reported a dozen Facebook bugs with similar payouts before.

Read more of the latest infosec research news

Last year, for example, he made $126,000 for discovering a set of three flaws in Facebook’s Canvas technology, with follow-up work netting him $98,000 earlier this year.

This latest payout, he says, “reflects the severity of the bug, and also how much Meta cares about the security of users accounts”.

We’ve invited Facebook to comment and will update if we hear anything further.

Full technical details can be found in Sammouda’s latest blog post.

YOU MIGHT ALSO LIKE Medical doctor charged with creating the Thanos ransomware builder