# How I bypassed Facebook CSRF once again!

Facebook Lead Ads Continued Flow auto-attached the victim's fb_dtsg CSRF token to attacker-controlled POST requests, enabling authenticated state-changing requests like disabling Timeline Review.

- Payout: $7,500
- Severity: high
- Program: Meta / Facebook
- Credited: Pouya Darabi
- Disclosed: 2016-05-17
- Write-up quality: 8/10
- Original: https://blog.darabi.me/2016/05/how-i-bypassed-facebook-csrf-in-2016.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-darabi-me-2016-05-how-i-bypassed-facebook-csrf-in-2016-html
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:high tech:rest technique:chained technique:source-review vuln:access-control vuln:auth-bypass vuln:csrf

**Target:** Lead Ads Continued Flow form submission endpoint
**Root cause:** Continued Flow POST submissions automatically included the user's fb_dtsg anti-CSRF token, and the destination URL was attacker-controllable. The Continued Flow whitelist was also not enforced server-side, allowing non-whitelisted accounts to create such forms.
**Steps:**
1. Create a normal Lead Ad form via the form-creation endpoint, which accepts a JSON config.
2. Fetch a previously created form via the JSON-returning endpoint to discover Continued Flow fields.
3. Add those Continued Flow fields to the form-builder JSON and set destination to `https://facebook.com/ajax/settings/timeline/review.php?tag_approval_enabled=0&__a=1`.
4. Submit the form; server accepts despite account not being whitelisted.
5. Trigger the Lead Ad via Facebook's Lead Ads testing tool; the POST executes with the victim's fb_dtsg token, disabling Timeline Review.
**How found:** Recalled a prior CSRF bypass and hypothesized that some Facebook feature could emit requests carrying fb_dtsg. Reviewed Lead Ads Continued Flow docs, noticed POST submissions auto-add fb_dtsg, then compared JSON from the form-creation endpoint against a form-fetch endpoint to discover hidden Continued Flow fields and injected them manually.
**Exploitation:** Attacker builds a Continued Flow Lead Ad whose destination is a Facebook state-changing endpoint (e.g. timeline review settings). When a victim completes the form, Facebook sends a POST to that endpoint automatically including the victim's fb_dtsg token, so the server accepts it as authenticated and applies the change.
**Escalation:** Any state-changing Facebook endpoint accepting fb_dtsg could be targeted, not just Timeline Review; the whitelist bypass widened who could build the primitive.
**Insight:** When a feature auto-attaches anti-CSRF tokens to outbound requests, treat it as a token-minting primitive: look for any user-controllable destination. Also diff JSON returned by read endpoints against what write endpoints accept to find hidden/whitelisted fields the server fails to validate.