- A security flaw found in Facebook’s advertising platform has been fixed by Meta
- The researcher who discovered the bug was awarded a $100,000 bug bounty
- The bug allowed the researcher to effectively take control of a Facebook server
Meta has awarded cybersecurity researcher Ben Sadeghipour a $100,000 bug bounty after he discovered a security vulnerability in Facebook’s advertising platform in October 2024.
The flaw allowed Sadeghipour to run commands on the internal Facebook server that housed the platform, giving him control over the server.
According to Sadeghipour, the unpatched bug allowed him to hijack the server using a headless Chrome browser, which is a version of the browser users run from the computer’s terminal, to interact with Facebook’s internal servers directly.
Part of wider researcher
The flaw in the platform was linked to a server that Facebook used to create and serve ads, which was vulnerable to a previously fixed bug found in the Chrome browser that Facebook uses in its ad system.
Sadeghipour told TechCrunch online advertising platforms are attractive targets because “so much goes on behind the scenes to create these ‘ads’ – whether they’re video, text or images.”
“But at the heart of it all, it’s a lot of data being processed on the server side, and that opens the door to a ton of vulnerabilities,” Sadeghipour said.
The researcher confirms that he didn’t test everything he could while inside the server, although “what makes this dangerous is that this was probably part of an internal infrastructure.”
After reporting the vulnerability to Meta, the bug took only an hour to fix, Sadeghipour said, noting that his discovery was part of “ongoing research on a specific application with a specific purpose.” This bug in particular took him a few hours to identify, but Meta worked with him to quickly fix the bug and offered a bounty that was “way beyond” expectations, he confirmed in a LinkedIn post.
Bug bounties have been on the rise recently, with Google drastically increasing its rewards for researchers who participate in the program so that security research becomes more lucrative.
