Researchers found a zero-click Facebook account takeover

A critical vulnerability in Facebook could have allowed threat actors to hijack any Facebook account, researcher warns.

Meta addressed a critical Facebook vulnerability that could have allowed attackers to take control of any account.

The Nepalese researcher Samip Aryal described the flaw as a rate-limiting issue in a specific endpoint of Facebook’s password reset flow. An attacker could have exploited the flaw to takeover any Facebook account by brute-forcing a particular type of nonce.

Meta awarded the researchers for reporting the security issue as part of Facebook’s bug bounty program.

The researchers discovered that the issue impacts Facebook’s password reset procedure when the user selects “Send Code via Facebook Notification.”

Analyzing the vulnerable endpoint the researcher discovered that three conditions opened the door for a brute-force attack:

1. The nonce sent to the user is active for longer than I expected (≈ 2 hrs)
2. The same nonce code was sent every time for the period.
3. I didn’t see any sort of code invalidation after entering the correct code but with multiple previous invalid tries (unlike in the SMS reset functionality).

Choosing the option “Send Code via Facebook Notification” will send a POST request to:

POST /ajax/recover/initiate/ HTTP/1.1

with the parameter; recover_method=send_push_to_session_login

Then the researchers attempted to send a 6-digit code ‘000000’ to analyze the POST request sent to the vulnerable endpoint:

POST /recover/code/rm=send_push_to_session_login&spc=0&fl=default_recover&wsr=0 HTTP/1.1

where “n” parameter holds the nonce.

At this stage, bruteforcing this 6-digit value had become a trivial task for the expert.

“there was no rate limiting on this endpoint, thus the matching code was responded back with a 302 status code. Use this code to log in/reset the FB account password for the user account.” reads the analysis published by Aryal.

The researcher noticed that upon exploiting this vulnerability, Facebook would notify the targeted user. The notification would either display the six-digit code directly or prompt the user to tap the notification to reveal the code.

The researcher reported the flaw to Meta on January 30, 2024, and the company addressed the issue on February 2nd, 2024. This vulnerability had a huge impact, Meta recognized it as a zero-click account takeover exploit. Aryal is currently ranked in first place in Facebook’s Hall of Fame 2024.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Meta)