Image removal vulnerability in Facebook polling feature
Delete any
Image on Facebook
When I was checking out facebook's new features, I noticed that polling feature were added to the posts so I start working on it.
Whenever a user tries to create a poll, a request containing gif URL or image id will be sent,
poll_question_data[options][][associated_image_id] contains the uploaded image id.
When this field value changes to any other images ID, that image will be shown in poll.
After sending request with another user image ID, a poll containing that image would be created.
 |
| Our uploaded image has been replaced by victim's image |
At the end when we try to delete the poll, victim's image would be deleted with it by facebook as a poll property.
POC:
I appreciate Facebook security team for resolving this vulnerability quickly.
TimeLine:
3 Nov 2017, 03:16 – Report Sent
3 Nov 2017, 15:25 – Triaged
3 Nov 2017, 16:46 - Temporary fix
5 Nov 2017, 15:03 - Permanent fix
8 Nov 2017 $10,000 Bounty awarded
