Story OF MY 3RD Bounty From Facebook

3 years ago 140

BOOK THIS SPACE FOR AD

ARTICLE AD

Hi , I am Aashish Jung Kunwar from Dhangadhi , Nepal . Today I am back with a new writeup . The writeup is about how I got my 3rd bounty after reporting a Functional security issue to Facebook Security Team .

Proof Of Concept :

What I Submitted :

Title

ADMIN CANNOT REMOVE DEACTIVATE USER FROM GROUP CHAT

Product Area

FBLite

Description/Impact

Complete Details
Admin of group chat cannot remove deactivate user .

Impact

Dead Facebook user with active messenger remains as Group member permanently. So, Admin should have access to remove deactivate user too .

Repro steps

Setup
Users: UserB , GroupA , AdminA .
Environment: UderB and AdminA are members of GroupA where AdminA is admin . UserB deactivated Facebook but using messenger .
App version: Facebook Lite

Steps
1. AdminA tried to remove UserB from GroupA .
2. UserB wasn’t removed .

They replied in less than 1 hour :

Hi Aashish,

We’re having a hard time reproducing the issue described in your report. Please reply with reproduction instructions (images and video would be helpful). In our testing we were able to remove deactivated users, can you verify if this is still reproducible by creating a new group and adding few test accounts then trying to remove one of them.

Thanks,

Tyler

I replied back with POC Video of Reproduction .

Conversation continued.

Hi Aashish,

We still are unable to reproduce, in our testing the removal part works just fine in FBLite, we are using FBDL test accounts to reproduce. Could you specify which build version you have of FBLite and also which phone model/make you are using, and are you using test accounts or real accounts. If you can reproduce with FBDL test users, can you provide video PoC for that?

Thanks,

Tyler

And, again they were unable to reproduce . Then, I was flabbergasted first off and I answered :

Hi,

I have tried using test accounts too . Using test accounts, we cannot deactivate messenger only and if we want to reactivate messenger only , it automatically reactivates Facebook account . So , it is impossible to reproduce using test accounts .

App version : 253.0.0.8.119
Phone Model : Samsung Galaxy J4

Thanks,
Aashish

Conversation stopped.

They closed the report as informative because report didn’t meet bar for monetary reward :

Hi Aashish,

Thanks for writing in.

We have discussed the issue at length and concluded that, whilst you reported a valid issue which the team may make changes based on, unfortunately your report falls below the bar for a monetary reward.

This is because the user still appears in the member list, therefore users in the chat can chose not send messages that they don’t want to be seen by that user. Note that if the user was hidden from the members list when they deactivated their account, that would have been a valid issue. In this case we consider this issue to be low impact and not eligible for a monetary reward.

I wish you luck in your continued bug hunting.

Thanks,

Tyler

I wasn’t satisfied .Then, I answered :

Hi ,

The deactivate member can easily see every messages of groups . S/he can do chat in group easily . S/he has only deactivated Facebook not messenger. That’s why none can remove him/her from group . So, it should be a issue with have high impact. Furthermore , what if the deactivate user is admin . The admin cannot be removed from group . Isn’t this irremovable GroupChat admins and members ?

Thanks,
Aashish

Finally , they triaged the report :

Hi Aashish,

Thank you for the additional explanation and thank you for reporting this information to us. We are sending it to the appropriate product team for further investigation. We will keep you updated on our progress.

Thanks,

Tyler

Then , I was so happy that the issue will surely qualify for bounty and I replied :

Hi,

Good to know the report is being sent to the appropriate product team for further analysis!
I am looking forward to hearing from the team for further updates soon .

Thanks,
Aashish

Fixed messaged :

Hi Aashish,

We have looked into this issue and believe that the vulnerability has been patched. Please let us know if you believe that the patch does not resolve this issue. We will follow up regarding any bounty decisions soon.

Thanks,

Tyler