Table of Contents
发现漏洞
Home Operation and Maintenance Safety How to analyze the source code leak vulnerability of Facebook Ads advertising business API interface

How to analyze the source code leak vulnerability of Facebook Ads advertising business API interface

May 11, 2023 pm 05:40 PM
facebook api ads

发现漏洞

一个多月后,我就发现了存在Facebook Ads广告业务系统API中的一个漏洞。存在漏洞的API是一个图片处理接口,它用于Facebook商户账户上传广告图片,上传的图片会储存在一个名为“/adimages”的目录下,并用base64格式编码。所以,我的测试构想是,在这里的机制中,可以向上传图片中注入恶意Payload,经API转换为 Base64 格式后,再被Facebook传入服务器中。

以下为上传图片的POST请求:

POST /v2.10/act_123456789/adimages HTTP/1.1

Host: graph.facebook.com

Bytes=VGhpcyBpcyBtYWxpY2lvdXMgcGF5bG9hZC4=

由于Facebook服务器端不能有效地处理恶意Payload图片,最终其“Image Resizing Tool”图片处理工具返回了一个报错,在某个JSON响应内容的异常消息中,就包括了一些PHP库函数代码,这些代码来自不同的Facebook库文件,可以肯定的是,这应该属于Facebook源代码的一部份。

HTTP/1.1 200 OK{“error”:{“message”:”Invalid parameter”,”type”:”FacebookApiException”,”code”:100,”error_data”:”exception ‘Exception’ with message ‘gen_image_rescale_multi_thrift call to shrinkImageMulti failed with fbalgo exception: 43 (43: : IDAT: invalid distance        too far back)’ in \/var\/www\/flib\/resource\/filesystem\/upload\/upload.php:1393\nStack trace:\n#0 \/var\/www\/flib\/resource\/filesystem\/upload\/upload.php(1662): gen_image_rescale_multi_thrift()\n#1 \/var\/www\/flib\/ads\/admanager\/adupload\/adupload.php(252):        gen_image_rescale_multi()\n#2 \/var\/www\/flib\/ads\/admanager\/adupload\/AdImageUtils.php(195): _gen_adupload_image_resize()\n#3 \/var\/www\/flib\/ads\/entities\/creatives\/photos\/AdproCreativePhotoDownload.php(53): AdImageUtils::genResizeLocalFile()\n#4        \/var\/www\/flib\/platform\/graph\/resources\/adaccount\/adimages\/mutators\/GraphAdAccountAdImagesPost.php(134): AdproCreativePhotoDownload::addLocalFileToCreativeLibrary()\n#5 \/var\/www\/flib\/core\/data_structures\/utils\/Arrays.php(440):        Closure$GraphAdAccountAdImagesPost::genImplementation#3()\n#6 \/var\/www\/flib\/platform\/graph\/resources\/adaccount\/adimages\/mutators\/GraphAdAccountAdImagesPost.php(136): Arrays::genMapWithKey()\n#7 \/var\/www\/flib\/ads\/api\/graph_base\/GraphAdsWriteWithRedirectBase.php(22):        GraphAdAccountAdImagesPost->genImplementation()\n#8 \/var\/www\/flib\/ads\/api\/graph_base\/GraphAdsWriteWithRedirectBase.php(11): GraphAdsWriteWithRedirectBase->genDoCall()\n#9 \/var\/www\/flib\/core\/asio\/gen_utils.php(24): GraphAdsWriteWithRedirectBase->genCall()\n#10        \/var\/www\/flib\/platform\/api\/base\/ApiBaseWithTypedApiData.php(204): genw()\n#11 \/var\/www\/flib\/platform\/api\/base\/ApiBase.php(85): ApiBaseWithTypedApiData->genCallWithApiDataBase()\n#12 \/var\/www\/flib\/platform\/graph\/core\/runner\/GraphApiRunnerBase.php(373):        ApiBase->genMakeCall()\n#13 \/var\/www\/flib\/platform\/graph\/core\/GraphRequestProcessorBase.php(629): GraphApiRunnerBase->genCall()\n#14 \/var\/www\/flib\/platform\/graph\/core\/GraphRequestProcessorBase.php(45): GraphRequestProcessorBase->genExecuteSingleGraphRequestCore()\n#15        \/var\/www\/api\/graph\/server.php(168): GraphRequestProcessorBase->genExecuteSingleGraphRequest()\n#16 \/var\/www\/api\/graph\/server.php(174): gen_api_graph_server()\n#17 \/var\/www\/flib\/core\/asio\/Asio.php(35): gen_api_graph_server_wrapper()\n#18        (): Closure$Asio::enterAsyncEntryPoint()\n#19 \/var\/www\/flib\/core\/asio\/Asio.php(37): HH\\Asio\\join()\n#20 \/var\/www\/api\/graph\/server.php(180): Asio::enterAsyncEntryPoint()\n#21 {main}”,”error_subcode”:1487242,”is_transient”:false,”error_user_title”:”Image        Resize Failed”,”error_user_msg”:”Image Resize Failed:unknown reason”,”fbtrace_id”:”EN\/o9hmqwZz”},”__fb_trace_id__”:”EN\/o9hmqwZz”}

The above is the detailed content of How to analyze the source code leak vulnerability of Facebook Ads advertising business API interface. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undress AI Tool

Undress AI Tool

Undress images for free

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

A list of historical prices since the birth of Bitcoin BTC historical price trend chart (Latest summary) A list of historical prices since the birth of Bitcoin BTC historical price trend chart (Latest summary) Feb 11, 2025 pm 11:36 PM

Since its creation in 2009, Bitcoin’s price has experienced several major fluctuations, rising to $69,044.77 in November 2021 and falling to $3,191.22 in December 2018. As of December 2024, the latest price has exceeded $100,204.

How to learn Laravel How to learn Laravel for free How to learn Laravel How to learn Laravel for free Apr 18, 2025 pm 12:51 PM

Want to learn the Laravel framework, but suffer from no resources or economic pressure? This article provides you with free learning of Laravel, teaching you how to use resources such as online platforms, documents and community forums to lay a solid foundation for your PHP development journey from getting started to master.

Binance Trading App Official Website Download Portal Binance Trading App Official Website Binance Trading App Official Website Download Portal Binance Trading App Official Website Apr 24, 2025 pm 02:18 PM

To safely access the Binance official platform and download the APP, you can use the following steps: 1) Use a trusted search engine to search for "Binance" and check the domain name; 2) View the official social media to obtain the URL; 3) Consult the official customer service to confirm the URL; 4) Use a trusted navigation website. The steps to download the APP include: 1) Visit Binance official website; 2) Find the APP download portal; 3) Select the download method (scan the QR code, download the app store, and directly download the APK file).

All models of Hongmeng Smart will be upgraded to Huawei ADS 3.0 and will be rolled out starting in September All models of Hongmeng Smart will be upgraded to Huawei ADS 3.0 and will be rolled out starting in September Aug 07, 2024 pm 07:16 PM

At the end of the Hongmeng Smart Xingxing S9 and Huawei full-scenario new product launch conference held on the afternoon of August 6, Yu Chengdong released a piece of blockbuster news related to many Hongmeng Smart Xing car owners. 1. Yu Chengdong said at the end of the press conference that Hongmeng Zhixing’s four models of Wenjie M5, Wenjie M7, Wenjie M9 and Zhijie S7 will gradually launch the latest HUAWEIADS3.0 high-end intelligent driving system starting from September this year. , which means that all models of Hongmeng Zhixing will undergo major upgrades in terms of smart driving. It is understood that the HUAWEIADS3.0 high-end intelligent driving system was first installed on the Xiangjie S9. It uses the GOD neural network to achieve a leapfrog improvement from basic object recognition to a comprehensive understanding of driving scenes, thus enhancing driving safety.

A summary of the top ten virtual currency trading platforms A summary of the top ten virtual currency trading platforms Apr 21, 2025 am 09:33 AM

This article summarizes the information of the top ten virtual currency trading platform APPs, emphasizes the importance of secure access to the platform through official channels, and provides verification methods. At the same time, the article reminds investors to consider factors such as security, transaction fees, currency selection when choosing an APP, and pay attention to the risks of virtual currency trading.

Ouyi official website Ouyi okx official entrance link Ouyi official website Ouyi okx official entrance link Mar 21, 2025 pm 06:15 PM

With the increasing popularity of cryptocurrency trading, it is crucial to choose a safe and reliable trading platform. As the world's leading digital asset trading platform, Ouyi OKX is highly favored for its high security, rich trading products, good liquidity and user experience. However, the Internet is full of false information, and many users have difficulty identifying the official website of Ouyi OKX. This article will guide you how to safely and quickly access the Ouyi OKX official platform, avoid accidentally entering phishing websites, and ensure the security of your digital assets. We will introduce various methods such as search engines, third-party websites, official social media, and official apps to find official portal links, and provide important security tips to help you conduct safe and reliable cryptocurrency transactions on the Ouyi OKX platform.

The latest entrance address of Binance Exchange in 2025 The latest entrance address of Binance Exchange in 2025 May 07, 2025 pm 07:00 PM

As the world's leading cryptocurrency exchange, Binance is always committed to providing users with a safe and convenient trading experience. Over time, Binance has continuously optimized its platform features and user interface to meet the changing needs of users. In 2025, Binance launched a new login portal aimed at further improving the user experience.

What are the functions of AI live streaming tools? What are the functions of AI live streaming tools? Nov 29, 2024 am 10:22 AM

AI live broadcast tools improve the live broadcast experience through artificial intelligence and provide core functions: 1. Automated content creation; 2. Audience interaction; 3. Audience analysis; 4. Content recommendation; 5. Personalized experience. It also provides features such as live editing, multi-platform integration, virtual backgrounds, automatic transcription and real-time translation.

See all articles