Facebook - Unrestricted File Upload

I found a vulnerability by which i could upload any file and send the to other user. It could also be script files and with this method I could also share porn, violence, illegal graphics/video/image without getting it filtered or removed

Posted  3,220 Views updated 3 years ago

1. Summary

I found a bug in Facebook that allowed me to upload any kind of file. Also the picture or Link I send thru that method would not be filtered or scanned for virus/pornographic. And later I also discovered it would allow me to download files from facebook server.

2. Report Submitted


Bypass Pornographic/illegal image share filter on message

Vuln Type


Product Area

Facebook - Web


Complete Details
Facebook block people from sharing child porn and other illegal graphics via message or post. I guess it uses some AI to filter image and block/delete/disable them. But I found a way by which anyone can share illegal images on facebook. Not only that but also it displays a big 'GIPHY' banner on image which makes bad reputation of their product.

Sharing of illegal stuffs, putting false source banner on resources,

Repro Steps

Users: Sender, Victim

Environment: Sending normal message to user via browser messenger

Browser: Chrome v79.0.3945.117

OS: Win 10 x64

Description: I just sent a normal message and interpreted it with burp suite

Step 1. Open and configure burp suite

Step 2. Go to facebook.com/messages/t on browser

Step 3. Open GIF sender but don't send GIF

Step 4. Turn on interceptor in burp suite

Step 5. Change the GIF source url with bad image and send

This way I can send any bad image to any user and won't get blocked and also image will be marked as GIPHY image which may lead to violation of GIPHY terms for facebook.

I have also attached Video demonstration

3. Video Demonstration

4. More about report

About a day later after i submitted the report, I was just playing with the bug and I discovered I could include the file from the server and download anyfile from facebook server. However they told me the file included was from CDN server (Where user uploaded photos/videos are saved) and not the main server of the facebook so it won't be that much risk and they rated my report as high severity. If it was actual server it would have got Critical severity. Anyways here's what I told in reply to my report,



I found that i can include any file from server with this method and download it. I can just change GIF file url to any file path in facebook server and it will send a copy of file from server and I can download it. This way I can download codes or files from facebook server or facebook script. Please check it. Try adding server path (For e.g. /etc/passwd) instead of GIF url and it will send the file and you can download it.


5. Conclusion

I was lucky to find the LFI while the report was still in progress/ not triaged. However some programs may not accept more impacts to the report once they have been triaged which will lead to less reward and less severity rating. So I suggest you all to check the bug/exploit for some time before reporting it. Do not hurry, after you find the bug play with it(Make sure to follow rules and regulations) try to find more impacts which will help in better rewards and rating.

Your reaction?