Facebook logic flaw allowed an expert to delete any video

Pierluigi Paganini June 25, 2016

Facebook has fixed a serious logic flaw that could have been exploited by hackers to delete any video uploaded in comments on someone’s Facebook post.

Facebook has fixed a serious security vulnerability in the Facebook’s platform that could have been exploited by hackers to delete any video uploaded in comments on someone’s Facebook post.

The security flaw was discovered by the Indian security researcher Pranav Hivarekar, who demonstrated that was able to delete any video by exploiting a security issue that exists in the recently introduced video comment feature. The feature allows Facebook users to upload Videos to reply to posts by people and pages, as well as within groups and events.

Hivarekar explained that the issue was a logic flaw and not a technical vulnerability.

“I came across a note New: Videos in Comments!  written by Bob Baldwin who works at Facebook. This note was about Facebook launching it’snew feature of commenting using videos. eg. Now, users were allowed to upload a video in comments.” Hivarekar wrote in a blog post.

“When I saw this note, at that time this video comment feature was already out 8 hrs ago. So, I started playing around and testing this feature to find out how it works. After, 2 hrs I was able to figure out some pretty interesting low impact flaws. Using these low impact flaws, I was able to form a bug to DELETE ANY VIDEO !

Hivarekar was playing with the feature when noticed that everytime a video is uploaded by users it was also published onto his Facebook timeline and is given a video ID.

The hacker making some tests with some Facebook API requests was able to delete any video uploaded as a comment by referencing it with the video ID.

The logic devised by the hacker is simple, by using the Facebook API he created a comment, then he sent another API request to attach any video ID from any user as the comment.
The last step consists in using another API request to delete the comment.

“I love API. So, I got to this via GraphAPI. Below is simple attack logic.

  1. Create a comment via api.
  2. Edit the comment and attach video of your choice using video_id via api.
  3. Delete the comment via api.

This was removing the attached video using it’s video-id.

Here, there are two simple flaws …
1. I am able to attach anyone’s video to my comment using it’s video-id.
2. When I delete my comment, then attached video gets deleted. As it uses ONLY video-id and there are no permission checks placed to verify if the user owns the video. Assumptions are made that user will ONLY upload/attach his/her own” explained the expert.

Facebook video in comments

The researcher published a Proof-of-concept to demonstrate how to trigger the issue, he highlighted that Facebook was not checking that the user deleting a particular comment was the owner of that comment and the owner of the attached video.

The Facebook security team promptly fixed the issue, Hivarekar explained that the flaw was temporarily fixed in just 23 minutes after confirmation of flaw, meanwhile, the permanent fix was deployed in 10-12 hrs after that.

The good news is that Facebook rewarded the expert a five-digit bug bounty for his efforts.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Facebook Comments in Video, hacking)



you might also like

leave a comment