# CSRF in partners.facebook.com

partners.facebook.com onboarding endpoints accepted POSTs without fb_dtsg CSRF token, letting an attacker forge site submissions and banner uploads on behalf of victims.

- Payout: $5,000
- Severity: high
- Program: Meta / Facebook
- Credited: Prashanth Varma
- Disclosed: 2016-09-20
- Write-up quality: 6/10
- Original: https://github.com/cymtrick/lol/blob/d17ed765129b26a1bf8060757e5aebd4e237c908/_posts/2016-09-20-Facebook-partners-CSRF.md
- Library page: https://bugbountylibrary.com/r/blog%3Agithub-com-cymtrick-lol-blob-d17ed765129b26a1bf8060757e5aebd4e237c908-posts-2016-09-20-facebook-partners-csrf-md
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:high tech:php technique:source-review vuln:csrf

**Target:** partners.facebook.com onboarding submit and image upload endpoints
**Root cause:** Server-side handlers for /cp/onboarding/submit/ and /cp/onboarding/images/submit/ did not validate the fb_dtsg CSRF token, returning 200 even when it was stripped.
**Steps:**
1. Reach https://partners.facebook.com/cp/onboarding/ via internet.org site submission flow.
2. Capture the POST /cp/onboarding/submit/ request containing `fb_dtsg=[token]`.
3. Remove the `fb_dtsg` parameter and resend; server returns 200 with a goURI redirect to the new submission_id.
4. Repeat on POST /cp/onboarding/images/submit/ with multipart banner upload; also returns 200 without token.
5. Craft an auto-submitting cross-site form to forge submissions/banner changes for a logged-in victim.
**How found:** Inspired by Jack Whitton's messenger.com site-wide CSRF writeup; reasoned that a rarely-visited onboarding site would have weak checks, tried IDOR first (failed), then stripped fb_dtsg and observed a 200 response.
**Exploitation:** Attacker hosts a page that auto-POSTs a forged form to partners.facebook.com/cp/onboarding/submit/ (and images/submit/) while the victim is logged in; since fb_dtsg is not checked, the submission is created/modified under the victim's account, potentially altering their listed site and banner.
**Escalation:** Using submission_id of existing posts, an attacker could modify already-submitted sites, affecting site owners' reputation.
**Insight:** On large platforms, low-traffic partner/onboarding subdomains often reuse the main app's fb_dtsg pattern but skip server-side validation; strip the token and check for 200 + state change rather than assuming the framework enforces it.