Facebook CSRF leading to full account takeover (fixed) (opens in new tab)

Congrats. This is exactly how responsible disclosure is supposed to work. You spend valuable time looking for holes and when you find one they fix it quickly and compensate you for your trouble.

That's awesome. Congrats to making the money, and raising the issue correctly - as well as not going off of the ethical deep end.

Out of curiosity, how much time did you spend on this?

Were you able to do this all with the dummy accounts that Facebook provides for the Bug Bounty program or did any steps require a genuine account? Just curious as I always wonder whether there are bugs that affect genuine accounts and not dummy accounts or vice-versa.

That's awesome.

Also sounds like you should maybe try to move to a different country, if you can!

Probably worth $500k to government actor.

Svaka cast druze :)

I disagree with that. It's a get request that is changing state server-side. That is a dead giveaway for a CSRF vulnerability.

They didn't validate the token nor did they make sure the user id was valid for the request; that's two important checks that either weren't there or failed. Seems like they just weren't there as there would have been more failures like this throughout the site. Because those checks weren't there I'd say it was an amateur mistake. Again, if this is the case then the engineer just made an assumption that this request can only be made in particular user state.

Not really, no.

Most responsible disclosure is normally posted about sooner though. I think what the OP meant is that waiting 2 months later, and then giving the post this title, makes it seem as though it was a more recent bug

If you read the OP, you'll find that's what happened.

I wasn't at all suggesting disclosing a bug before it's fixed. The write-up was great, the disclosure correct. I was merely saying that the HN title should reflect the current state of affairs.

I meant by the others who are trying to win the bounty.