A researcher has earned $55,000 from Facebook for reporting a serious vulnerability that could have been exploited by hackers to steal access tokens and hijack accounts.
India-based researcher Amol Baikar discovered in December that the “Login with Facebook” feature, which allows users to log in to other websites with their Facebook account, was affected by a vulnerability.
Baikar found that an attacker could hijack the OAuth flow — the feature uses the OAuth 2.0 authorization protocol — and steal a user’s access tokens for apps that use the OAuth flow, such as Instagram and Oculus. For the attack to work, a hacker would have needed to convince the targeted user to visit a malicious website.
Facebook was informed about the vulnerability on December 16 and a patch was released within a week. However, the researcher found a way to bypass the patch and a more efficient fix was rolled out in mid-January.
Baikar said he received a total of $55,000 from Facebook for his initial report and the patch bypass. The researcher said this was the highest bounty paid out by the social media giant for a client-side account takeover vulnerability.
“We’ve fixed the issue and haven’t seen any evidence of abuse,” Facebook told SecurityWeek. “We’re grateful for this researcher’s help to keep our platform safe.”
The company said the flaw was introduced in May 2019 and it was patched in January by altering the restrictions for the OAuth flow and through a code fix designed to prevent communication with untrusted websites.
Facebook last year paid out a total of roughly $2.2 million through its bug bounty program, reaching nearly $10 million since the launch of its program in 2011.
Baikar has published a blog post describing the technical details of the vulnerability.
Related: CSRF Vulnerability in Facebook Earns Researcher $25,000
Related: GIF Attack on Facebook Messenger Earned Hacker $10,000
Related: Facebook Rushes to Patch Bug Exposing Page Admins
Related: Instagram Account Takeover Vulnerability Earns Hacker $30,000