Meta Pays Bug Bounty for an MFA Bug

Meta has paid a bug bounty to a researcher for disclosing the details of a two-factor authentication vulnerability for confirming a phone number, and the email address did not have any rate-limiting protection.

Manoz, the researcher from nepal, said he has discovered the vulnerability while analyzing a new Meta Accounts Center page in Instagram. Users can add an email address and phone number to their Instagram account and the Facebook account linked to their Instagram. In order to verify the email address and phone number, users have to enter a six-digit code received via email or SMS.

The system verifying the six-digit code did not have any rate limition, which could have allowed an attacker to enter every possible code until they got the right one. By exploiting the vulnerability, the attacker could have obtained the six-digit verification code through a brute-force attack and assigned the victim’s phone number to an account they controlled.

This resulted in the phone number being removed from the victim’s Facebook and Instagram account and 2FA getting disabled due to security reasons.

Meta rolled out a fix in October 2022 and also highlighted the findings in its annual bug bounty program report. Meta decided to pay out $27,200 for the researcher’s findings.