Media deletion CSRF vulnerability on Instagram

In January 2019, I discovered a CSRF vulnerability in Instagram's copyright workflow that could be abused to delete a victim's own post or story.

The issue existed in a copyright-related endpoint that performed a destructive action through a GET request without requiring a CSRF token or equivalent anti-CSRF protection.

Product Instagram
Issue Cross-Site Request Forgery (CSRF)
Impact Delete a victim's Instagram post or story
Reported January 29, 2019
Fixed January 30, 2019
Bounty $3,000
Instagram copyright notification related to the CSRF vulnerability
Instagram copyright notification shown for media that triggered the copyright workflow.

Background

Instagram had introduced a copyright workflow for media that potentially violated another person's copyright.

When Instagram detected such content, the affected user could receive a notification with options related to the copyrighted media, including removing the content or requesting an appeal.

After uploading a video that triggered this copyright workflow, I started reviewing the related requests and endpoints.

The Vulnerability

I found that Instagram exposed a copyright endpoint capable of deleting the affected media through a GET request.

The vulnerable endpoint followed this pattern:

https://www.instagram.com/media/{MEDIA_ID}/copyright/dismiss_am/

The MEDIA_ID could reference either a Story ID or a Post ID.

Because the deletion action did not require a CSRF token or another effective request-verification mechanism, an attacker could cause a logged-in victim to invoke the endpoint simply by making them open a crafted URL.

Impact

Opening the malicious URL while authenticated to Instagram could cause the referenced media to be deleted from the victim's account.

The behavior worked in both the Instagram web interface and the Android application, allowing an attacker to trick a victim into deleting content they had previously posted.

Instagram CSRF report showing media deletion vulnerability details
Evidence from the Instagram CSRF vulnerability report.

Android Proof of Concept

The following PoC demonstrates deletion of an Instagram Story from Android.

Web Proof of Concept

The same issue could also be exploited through the web interface to delete an Instagram post.

Resolution

Instagram triaged the report on the same day and deployed a permanent fix the following day.

Disclosure Timeline

January 29, 2019 Vulnerability reported to Instagram.
January 29, 2019 Report triaged.
January 30, 2019 Permanent fix deployed.
February 14, 2019 $3,000 bounty awarded.

No comments