Cyber Security

Instagram‌ ‌Bug Allowed Anyone to View Private Accounts Without Following Them

Instagram has patched a new flaw that allowed anyone to view archived posts and stories posted by private accounts without having to follow them.

“This bug could have allowed a malicious user to view targeted media on Instagram,” Mayur Fartade said in a Medium post today. “An attacker could have been able to see details of private/archived posts, stories, reels, IGTV without following the user using Media ID.”

Stack Overflow Teams

Fartade disclosed the issue to Facebook’s security team on April 16, 2021, following which the shortcoming was patched on June 15. He was also awarded $30,000 as part of the company’s bug bounty program.

Although the attack requires knowing the media ID associated with an image, video, or album, by brute-forcing the identifiers, Fartade demonstrated that it was possible to craft a POST request to a GraphQL endpoint and retrieve sensitive data.

Prevent Ransomware Attacks

As a consequence of the flaw, details such as like/comment/save count, display_url, and image.uri corresponding to the media ID could be extracted even without following the targeted user, alongside exposing the Facebook Page linked to an Instagram account.

Fartade said he also discovered a second endpoint on April 23 that revealed the same set of information. Facebook has since addressed both leaky endpoints.

Articles You May Like

OpenAI Reveals Redis Bug Behind ChatGPT User Data Exposure Incident
PS5, PS5 Digital Edition to Receive Rs. 5,000 Discount From April 1 in India: All Details
Pegatron Said to Be in Talks to Open Second Factory ‘To Assemble Latest iPhones’ in Tamil Nadu
Twitter source code leaked online, court filings show
Asus ROG Phone 7 Confirmed to Launch Globally on April 13: Specifications and Features