Image removal vulnerability in Facebook polling feature

In November 2017, I discovered an access-control vulnerability in Facebook's newly introduced Polls feature that could be abused to delete an arbitrary image from Facebook.

The issue existed because Facebook accepted an attacker-controlled image ID when assigning images to poll options, but did not properly verify ownership of the referenced image. Once another user's image had been attached to the attacker's poll, deleting the poll also deleted the victim's image.

Product	Facebook
Feature	Polls
Issue	Broken object-level authorization / insufficient ownership validation
Impact	Delete an arbitrary Facebook image
Reported	November 3, 2017
Permanent fix	November 5, 2017
Bounty	$10,000

Facebook image deletion vulnerability through the Polls feature.

Background

Facebook had recently introduced a polling feature for posts. Since it was a new feature, I started reviewing its request flow and how media was attached to poll options.

The Facebook Polls interface used to create a poll with image-based options.

The Vulnerability

When a user created a poll using an uploaded image, the request included the image identifier assigned to each option.

The relevant request parameter was:

poll_question_data[options][][associated_image_id]

This parameter contained the ID of the uploaded image associated with a poll option.

The poll creation request containing the image identifier.

The backend did not properly verify that the supplied image ID belonged to the user creating the poll.

By replacing the legitimate associated_image_id value with the ID of another user's image, Facebook accepted the modified request and created a poll that referenced the victim's image.

The attacker's original poll image was replaced with the victim's image.

Turning the Reference Into Image Deletion

The more serious issue appeared when the poll was deleted.

Because Facebook had accepted the victim's image as a property of the attacker's poll, deleting the poll also caused Facebook to delete the referenced image itself.

This turned a missing ownership check into a destructive object-level authorization vulnerability: an attacker who obtained a target image ID could associate it with a poll they controlled and then trigger deletion of that image by removing the poll.

The target image after deletion was triggered through the poll.

Proof of Concept

Resolution

Facebook triaged the report the same day, deployed a temporary fix shortly afterward, and rolled out a permanent fix on November 5, 2017.

Disclosure Timeline

November 3, 2017 — 03:16	Vulnerability reported to Facebook.
November 3, 2017 — 15:25	Report triaged.
November 3, 2017 — 16:46	Temporary fix deployed.
November 5, 2017 — 15:03	Permanent fix deployed.
November 8, 2017	$10,000 bounty awarded.