I recently came across the following article.

Tl;dr: a real vulnerability was disregarded, so the security researcher exploited the vulnerability to get attention from Facebook's security team.

What particularly caught my attention was the fact that the team decided to not act on the report because they allegedly didn't have enough information to reproduce the bug, and hence simply replied "this is not a bug."

Also, this is the first time I came across such case in the news, yet it doesn't seem like an isolated event. That is, I have a feeling that this happens way more often.

  • How do teams decide when a report is not "actionable enough"? Does it happen often?

  • Are there other famous cases like the one above?

  • 1
    In my experience, the vast majority of vulnerability reports can be summed up as "OMG I foud a bug hackrs r going to take over!!!!!1!one!!@". Actual, usable vulnerability reports (or any other sort of bug report) happen maybe one time in ten. – Mark Jan 25 '18 at 21:42
  • Facebook would get a huge amount of report vulnerabilities from the public and bug bounties and only have limited resources to review and determine false positives. If a report lacks information they have to move on to the next one to keep on top of it all. – McMatty Jan 25 '18 at 22:57

A report to be usable needs to be reproducible - example payloads entry points tools used etc. A bug report means nothing if the reporter used a custom tool and payload that the security team and doesn't provide detailed steps and payloads.

Security teams also view applications differently than say a developer. To me the facebook issue is not a huge impact compared to a cmd injection or sql injection bug. Maybe they didn't triage this correctly and look at the potential impact - spammers leveraging this bug to post of everyoness page which in turn could link off to malicious payloads / sites

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.