A security vulnerability in Facebook business manager endpoint allows a third party application to hack Facebook account page with limited permissions and the victim will permanently lose admin access to the page.

Also, read how toin a few minutes and their prevention techniques

By default, Facebook application interface does not allow third-party applications to add or modify page admin roles (page roles like a manager, editor, analyst etc.). Third-party applications are allowed to perform all the operations like post statuses on your behalf, publish photos, etc. except adding admin roles because if an application is allowed to add or remove admins then it could add some user as an admin to the page and remove the actual owner permanently.



On the other hand, there is an endpoint for business pages called userpermissions that allows one to add or remove business page admin roles who are already handling the Facebook business.

The following request would make target user as admin of the page.

Request :-

POST /<page_id>/userpermissions HTTP/1.1

Host : graph.facebook.com

Content-Length: 245 role=MANAGER&user=<target_user_id>&business=<associated_business_id>&access_token=<application_access_token>

Response:-

true

After a few minutes of testing, I got to know that removing the business parameter from the request didn’t throw any error and allow us to add anyone as new page admin and delete the actual page admin on the non-business page where the application has manage_pages permission. That’s it! Whatever the application may be, if it is having the manage_pages permission of the admin then it could hack all of your Facebook account pages in a fraction of seconds.

Final Proof of Concept:-

If you are unable to understand then please watch this video.



Page Takeover :

Request :- POST /<page_id>/userpermissions HTTP/1.1 Host : graph.facebook.com Content-Length: 245 role=MANAGER&user=<target_user_id>&access_token=<application_access_token> true Removing Victim: