# How I discovered a 1000$ open redirect in Facebook

Facebook's log endpoints failed to validate the groupuri/uri parameter, allowing open redirect to arbitrary sites via fb.me short-link bypasses.

- Payout: $1,000
- Severity: medium
- Program: Meta / Facebook
- Found by: Yassine Aboukir (@Yassineaboukir)
- Disclosed: 2014-12-30
- Write-up quality: 6/10
- Original: https://www.yassineaboukir.com/blog/how-I-discovered-a-1000$-open-redirect-in-facebook/
- Library page: https://bugbountylibrary.com/r/blog%3Ayassineaboukir-com-blog-how-i-discovered-a-1000-open-redirect-in-facebook
- Tags: area:web domain:web impact:integrity kind:bounty platform:blog sev:medium technique:incomplete-fix technique:recon vuln:open-redirect

**Target:** Facebook web log endpoints (/browsegroups/addcover/log, /ads/manage/log)
**Root cause:** The groupuri/uri parameters were not fully validated, so a URL pointing to an attacker-controlled destination was accepted and used as a redirect target.
**Steps:**
1. Request `https://www.facebook.com/browsegroups/addcover/log/?groupid=1&groupuri=https://fb.me/7kFH9QAMH` where the fb.me short link resolves to evil.com
2. Observe redirect to evil.com
3. Bypass fix 1 with `groupuri=https://d.fb.me/7kFH9QAMH`
4. Bypass fix 2 with `groupuri=https://www.fb.me/7kFH9QAMH`
**How found:** Common open-redirect payloads (direct URL, ../, l.facebook.com wrapper) were blocked; noticing auto-generated fb.me short links in a Twitter feed led to trying the short-link domain as the redirect target, which bypassed the filter.
**Exploitation:** Attacker crafts a Facebook URL whose groupuri points to a fb.me short link resolving to a malicious site; victim clicking the trusted facebook.com link is redirected to the attacker's page for phishing.
**Escalation:** Repeatedly bypassed Facebook's successive fixes by switching to alternate fb.me subdomains (d.fb.me, www.fb.me).
**Insight:** When a redirect filter blocks direct external URLs, try the target's own URL-shortener domains and their subdomains (d., www., on.) as the redirect value, since they resolve off-site but pass allowlist checks.

## Proof of concept (copied exactly from the original report)

**Open redirect via fb.me shortlink in groupuri**

```
https://www.facebook.com/browsegroups/addcover/log/?groupid=1&groupuri=https://fb.me/7kFH9QAMH


https://www.facebook.com/browsegroups/addcover/log/?groupid=1&groupuri=https://l.facebook.com/l.php?u=https:// fb.me/7kFH9QAMH
```

**Bypass via d.fb.me subdomain**

```
https://www.facebook.com/browsegroups/addcover/log/?groupid=1&groupuri=https://d.fb.me/7kFH9QAMH
```

**Bypass via www.fb.me shortlink**

```
https://www.facebook.com/browsegroups/addcover/log/?groupid=1&groupuri=https://www.fb.me/7kFH9QAMH


https://www.facebook.com/browsegroups/addcover/log/?groupid=1&groupuri=https://www..fb.me/7kFH9QAMH
```