Massive YouTube vulnerability allows deleting any video on the site
Even software giants like YouTube and Google get their fair share of security problems. A few days ago, security researcher Kamil Hismatullin found a critical vulnerability in YouTube which allowed him to delete any video belonging to any user by simply sending a request.
A lucky escape for all hated YouTube videos
Kamil stumbled across this massive security bug while looking for Cross Site Request Forgery (CSRF) and Cross Site Scripting (XSS) issues.
The request used was:
POST https://www.youtube.com/live_events_edit_status_ajax?action_delete_live_event=1 event_id: ANY_VIDEO_ID session_token: YOUR_TOKEN
On testing out the above code, the bug hunter received a success response, and the target video was deleted. It was that simple. As mentioned by Kamil:
“In general I spent 6-7 hours to research, considering that couple of hours I’ve fought the urge to clean up Bieber’s channel haha.”
The issue was handled responsibly however, reported to YouTube and fixed within a few hours. It was a close call. Kamil received a pretty sizeable reward from Google as this bug in the wrong hands could have wrecked havoc on the world’s largest video sharing website.
Emsisoft Enterprise Security + EDR
Robust and proven endpoint security solution for organizations of all sizes. Start free trialHave a nice (video-full) day!
