Insufficient Rate Limitting on Facebook Fundraisers

Summary

Facebook Fundraisers Lacks Rate Limiting Protection. Malicious actors can bruteforce this by sending different random credit or debit card numbers. This could result to large scale fraud.


The Expected Behaviour is Once You tried to Repeatedly Link or Use a Declined or Invalid Credit/Debit Card the System Should block you from doing additional Transactions in Facebook as Part of its Anti Fraud Protections.

Proof of Concept

https://www.youtube.com/watch?v=2WhZi_h8Nd8

Timeline

May 28, 2019 – Report Sent
May 31, 2019 – First Response from Facebook
June 12, 2019 – Triaged
August 13, 2019 – Fixed
August 23, 2019 – Bounty Issued

Response from Facebook Security Team

#SharingIsCaring

8 thoughts on “Insufficient Rate Limitting on Facebook Fundraisers

  1. Naše spoleДЌnost v brzké dobД pЕ edstaví nové katalogy produktЕЇ a náhradních dílЕЇ dveЕ í Fermator a nové, upravené ceníky odráЕѕející tyto zmД ny.
    A permitted calculator may be used on the mathematics test only.
    Bus Floor Bottles 3 35 04.
    Рљ Рљ Р” 2012-11-06.
    Tommy tells them that the Fireflies lab is in the University of Eastern Colorado.

    https://madxaharcakinve.microidea.net/

  2. How long should you be in a deep sleep? Resurge is a powerful potent fat burning formula by John Barban, which does not only work for melting off fat, but also regulates the sleep cycle too. In fact, this product only works when a person is in his deep sleep.
    https://tinyurl.com/ydgrv2n4

  3. The sitar is also symbolic of the Indian culture.
    De Stroatklinkers from Harkstede in the Dutch province of Groningen, with Henk Bloupot on accordion and vocals, play mainly bluegrass, but sing in the Gronings dialect.
    Danish version, En sГёrgelig film by 13-year-old Dorthe Larsen she really looks sГёrgelig.
    Product Information How Deep Is Your Love by Calvin Harris – Digital Sheet Music.
    It was none other than James Hendricks , her first husband, who she had an annulment from, a year after their child s birth.

    http://coordiacallchotere.prosamkethefulledervidilitoci.co/

  4. “I haven’t seen you in these parts,” the barkeep said, sidling during to where I sat. “Name’s Bao.” He stated it exuberantly, as if solemn word of honour of his exploits were shared by way of settlers about multitudinous a fire in Aeternum.

    He waved to a unimpassioned tun hard by us, and I returned his token with a nod. He filled a glass and slid it to me across the stained red wood of the bench in the vanguard continuing.

    “As a betting houseman, I’d be delighted to wager a honourable speck of coin you’re in Ebonscale Reach in search more than the carouse and sights,” he said, eyes glancing from the sword sheathed on my with it to the salaam slung across my back.

    http://qsxh.xyz/home.php?mod=space&uid=159611

Leave a Reply

Your email address will not be published.