# Making the Facebook app more secure - $8500 bounty

Facebook Android deeplinks passed unvalidated URL params to WebViews, enabling open redirect, javascript: URI XSS, and local file read.

- Payout: $8,500
- Severity: high
- Program: Meta / Facebook
- Credited: Ashley King
- Disclosed: 2018-09-09
- Write-up quality: 6/10
- Original: https://ash-king.co.uk/facebook-bug-bounty-09-18.html
- Library page: https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-facebook-bug-bounty-09-18-html
- Tags: domain:mobile impact:data-leak kind:bounty platform:blog sev:high tech:react technique:recon technique:source-review vuln:info-disclosure vuln:open-redirect vuln:xss

**Target:** Android app deeplink handlers / WebView URL parameters
**Root cause:** Deeplink handlers (payments_add_paypal, ig_lwicreate_instagram_account_full_screen_ad_preview, ads_payments_prepay_webview) passed user-controlled url/adPreviewUrl params into WebViews without scheme validation, allowing javascript: and file: URIs.
**Steps:**
1. Extract APK, grep for 'fb://' to find assets/Bundle-fb4.js.hbc and react_native_routes.json
2. Parse react_native_routes.json into a DB of routes and paramDefinitions, generate adb deeplink commands
3. Enumerate 364 deeplinks via `adb shell am start -a android.intent.action.VIEW -d "fb://..."`
4. Identify URL-param routes: `fb://ig_lwicreate_instagram_account_full_screen_ad_preview/?adPreviewUrl={STRING}`
5. Test `adPreviewUrl=https://google.com` -> open redirect
6. Test `adPreviewUrl=javascript:confirm('...')` -> JS execution in WebView
7. Test `adPreviewUrl=file:///sdcard/CDAInfo.txt` -> local file read
**How found:** Recon focused on deeplinks; unpacked APK, grepped for 'fb://', found react_native_routes.json listing all routes, programmatically generated adb commands to brute-force 364 deeplinks, flagged routes taking a URL parameter and tested alternate URI schemes.
**Exploitation:** Attacker crafts a deeplink with javascript: or file: URI in the url/adPreviewUrl parameter; victim clicks link, app launches WebView loading the URI, executing JS in app context or reading local files. Facebook noted chaining with WebView misconfig could invoke internal endpoints and access sensitive HTML5 APIs.
**Escalation:** Facebook's internal code review found WebView configuration issues chainable with the reported bug to invoke internal app endpoints and access sensitive HTML5 APIs.
**Insight:** react_native_routes.json inside React Native APKs enumerates every deeplink and its paramDefinitions/types — parse it to auto-generate adb deeplink tests, then focus on params typed as URL and try javascript:/file:/intent: schemes.