# Abusing Facebooks `Call To Action` To Launch Internal Deeplinks

Page admins could inject internal fbinternal:// deeplinks into Facebook CTA buttons via Graph API, executing on mobile visitors' devices.

- Payout: $4,000
- Severity: medium
- Program: Meta / Facebook
- Credited: Ashley King
- Disclosed: 2022-02-02
- Write-up quality: 6/10
- Original: https://www.ash-king.co.uk/blog/abusing-Facebooks-call-to-action-to-launch-internal-deeplinks
- Library page: https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-blog-abusing-facebooks-call-to-action-to-launch-internal-deeplinks
- Tags: domain:api domain:mobile impact:integrity kind:bounty platform:blog sev:medium tech:graphql technique:source-review vuln:csrf vuln:info-disclosure

**Target:** Facebook Page Call-to-Action button / Graph API CTA object
**Root cause:** The Graph API CTA update endpoint accepted android_deeplink/iphone_deeplink and destination_type=APP_DEEPLINK fields without validating that the deeplink scheme was external, allowing fbinternal:// URIs to be stored and later launched by the mobile app.
**Steps:**
1. Create a Facebook page and set the Action Button to 'Use App' with a valid URL; capture the CTA id from the POST request.
2. POST to Graph API explorer: `POST /XXX?android_deeplink=fbinternal%3A%2F%2Fsupersecretfbinternallink&android_destination_type=APP_DEEPLINK` with CTA id as XXX and pages_manage_cta permissions.
3. Observe 'Success' response; re-fetch CTA object to confirm stored deeplink.
4. Visit the page from an Android device and click 'Use App' to trigger the internal deeplink.
5. Repeat with `iphone_deeplink` and `iphone_destination_type` keys for iOS.
**How found:** Spent hours probing the Graph API CTA object; noticed the documentation exposed android_deeplink/iphone_deeplink and destination_type fields, hypothesized they could carry internal schemes, and replayed the CTA update with fbinternal:// payloads.
**Exploitation:** A page admin sets a CTA with an fbinternal:// deeplink; any mobile visitor who taps the CTA button has the internal deeplink launched on their device, enabling CSRF and user de-anonymization against visitors.
**Insight:** When a feature exposes platform-specific deep-link fields (android_deeplink, iphone_deeplink) in a public API, test whether internal URL schemes (fbinternal://, app://) are accepted and later auto-launched by the mobile client.