In January 2019, I discovered a CSRF vulnerability in Instagram's copyright workflow that could be abused to delete a victim's own post or story.
The issue existed in a copyright-related endpoint that performed a destructive action through a GET request without requiring a CSRF token or equivalent anti-CSRF protection.
| Product | |
|---|---|
| Issue | Cross-Site Request Forgery (CSRF) |
| Impact | Delete a victim's Instagram post or story |
| Reported | January 29, 2019 |
| Fixed | January 30, 2019 |
| Bounty | $3,000 |
Background
Instagram had introduced a copyright workflow for media that potentially violated another person's copyright.
When Instagram detected such content, the affected user could receive a notification with options related to the copyrighted media, including removing the content or requesting an appeal.
After uploading a video that triggered this copyright workflow, I started reviewing the related requests and endpoints.
The Vulnerability
I found that Instagram exposed a copyright endpoint capable of deleting the affected media through a GET request.
The vulnerable endpoint followed this pattern:
https://www.instagram.com/media/{MEDIA_ID}/copyright/dismiss_am/
The MEDIA_ID could reference either a Story ID or a Post ID.
Because the deletion action did not require a CSRF token or another effective request-verification mechanism, an attacker could cause a logged-in victim to invoke the endpoint simply by making them open a crafted URL.
Impact
Opening the malicious URL while authenticated to Instagram could cause the referenced media to be deleted from the victim's account.
The behavior worked in both the Instagram web interface and the Android application, allowing an attacker to trick a victim into deleting content they had previously posted.
Android Proof of Concept
The following PoC demonstrates deletion of an Instagram Story from Android.
Web Proof of Concept
The same issue could also be exploited through the web interface to delete an Instagram post.
Resolution
Instagram triaged the report on the same day and deployed a permanent fix the following day.
Disclosure Timeline
| January 29, 2019 | Vulnerability reported to Instagram. |
|---|---|
| January 29, 2019 | Report triaged. |
| January 30, 2019 | Permanent fix deployed. |
| February 14, 2019 | $3,000 bounty awarded. |
No comments