Facebook has fixed a serious logic flaw that could have been exploited by hackers to delete any video uploaded in comments on someone’s Facebook post.

Facebook has fixed a serious security vulnerability in the Facebook’s platform that could have been exploited by hackers to delete any video uploaded in comments on someone’s Facebook post.

The security flaw was discovered by the Indian security researcher Pranav Hivarekar, who demonstrated that was able to delete any video by exploiting a security issue that exists in the recently introduced video comment feature. The feature allows Facebook users to upload Videos to reply to posts by people and pages, as well as within groups and events.

Hivarekar explained that the issue was a logic flaw and not a technical vulnerability.

“I came across a note New: Videos in Comments!  written by Bob Baldwin who works at Facebook. This note was about Facebook launching it’snew feature of commenting using videos. eg. Now, users were allowed to upload a video in comments.” Hivarekar wrote in a blog post.

“When I saw this note, at that time this video comment feature was already out 8 hrs ago. So, I started playing around and testing this feature to find out how it works. After, 2 hrs I was able to figure out some pretty interesting low impact flaws. Using these low impact flaws, I was able to form a bug to DELETE ANY VIDEO !“

“I love API. So, I got to this via GraphAPI. Below is simple attack logic.

1. Create a comment via api.
2. Edit the comment and attach video of your choice using video_id via api.
3. Delete the comment via api.

This was removing the attached video using it’s video-id.

Here, there are two simple flaws …
1. I am able to attach anyone’s video to my comment using it’s video-id.
2. When I delete my comment, then attached video gets deleted. As it uses ONLY video-id and there are no permission checks placed to verify if the user owns the video. Assumptions are made that user will ONLY upload/attach his/her own” explained the expert.