Join Facebook Group With Unpublish Page

Publish a page without publishing it

بِسْمِ للَّٰهِ لرَّحْمَٰنِ لرَّحِيمِ

Hey, welcome to this write-up!

What I’ve found is only from Allah’s will, actually I’m nothing.

Note:

  • There’s “TL;DR” section for those who only need the main point of this write-up.
  • I really apologize if my write-up is bad.
  • By the way, this is my first write-up.

Enjoy :)

I. TL;DR

  • You can join public facebook group using your facebook page. But, you can’t do it with unpublish page.
  • When you click join group button, there’s profile selector to choose your page/profile.
  • Intercept the request when you choose one of it.
  • There’s “actor_id” parameter with selected facebook page/profile ID as value.
  • Change the value to your unpublish page ID.
  • Also, i can post a limited status with that unpublish page by changing “actor_id” value in “Create Post” feature.

II. Introduction

Groups are a place to communicate about shared interests with certain people. You can create a group for anything — your family reunion, your after-work sports team or your book club.

To join group, you can use your primary Facebook profile or your Facebook page as long as the group admin allow it.

Admin Settings (https://www.facebook.com/groups/{id}/edit)

If the group admin allow page to join, you’ll notice selector like this when clicking “Join Group” button, so you can choose how to join group:

Profile Selector

But only published page that able to join group.

The answer is, no. If you try to directly access the unpublish page with their URL, you’ll get this message:

“Not Found” message.

III. The Findings

When I testing around group features back then, I just found out that I can join the group with my page, without thinking too much, I immediately mess with it.

And then I noticed a weird situation, I only saw a few of the many created pages I have. Apparently, the page that didn’t appear was the page that still unpublished or I don’t have enough permissions (I’m not the page admin, etc).

So i tried to intercept the request when i choose one of my page/profile, and request like this appear:

Profile Selector Request (Illustration)

I change “actor_id” value to my unpublish page, then send the request.

Immediately I check my dummy account (group admin), it’s success, the unpublish page appear in group “Member Request” page (it’s because I enabled pre-approved feature)

Just Illustration

Also, I able to approve it.

IV. Exploitation

As far as I can remember, I couldn’t post anything using that page, because I couldn’t choose the profile (maybe because it’s unpublish), so I try to find way how to exploit this. Actually, the successful of joined page is enough, but i tried to increase the impact.

I decided to test “Create Post” feature.

Create Post Feature

By intercepting request after clicking “Post” button, request like this appear:

“Post” feature request illustration

As you can see, there’s also “actor_id” parameter, then I change the value with the previous unpublish page ID, and send the request.

It’s worked!

But I can’t post “Attachment” things like image, file, watchparty, etc. Except for GIF, I don’t know why.

I tried to do the same things on “Like” and “Comment” feature (by changing the “actor_id” value), but I only able to comment on my post.

V. Lesson Learned

When you are faced with a selector that you can select some things (in this case, profile), always try to do IDOR. Also, try to increase the impact of what you’ve found until you get stuck.

VI. Timeline

September 16, 2020 — Report sent

September 19, 2020 — Triaged by Facebook team

September 29, 2020 — Facebook team need more info

September 29, 2020 — I Sent more info

October 15, 2020 — Vulnerability patched

October 16, 2020 — Bounty rewarded

Alhamdulillah, finally this write-up ends here.

Hit me up if you have any inquiries: https://twitter.com/Geva_7

Your bio appears on your Profile and next to your stories. Max 160 characters.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store