Insufficient Rate Limitting on Facebook Fundraisers

Summary

Facebook Fundraisers Lacks Rate Limiting Protection. Malicious actors can bruteforce this by sending different random credit or debit card numbers. This could result to large scale fraud.


The Expected Behaviour is Once You tried to Repeatedly Link or Use a Declined or Invalid Credit/Debit Card the System Should block you from doing additional Transactions in Facebook as Part of its Anti Fraud Protections.

Proof of Concept

Timeline

May 28, 2019 – Report Sent
May 31, 2019 – First Response from Facebook
June 12, 2019 – Triaged
August 13, 2019 – Fixed
August 23, 2019 – Bounty Issued

Response from Facebook Security Team

#SharingIsCaring

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.