# Delete any Video or Reel on Facebook (11,250$)

GraphQL crop/reframe endpoint accepted any videoID and malformed aspect-ratio values, letting an attacker corrupt and effectively delete any Facebook video or Reel.

- Payout: $11,250
- Severity: high
- Program: Meta / Facebook
- Credited: Bassem M Bazzoun
- Disclosed: 2022-12-21
- Write-up quality: 7/10
- Original: https://bugreader.com/social/write-ups-general-delete-any-video-or-reel-on-facebook-11-250--100965
- Library page: https://bugbountylibrary.com/r/blog%3Abugreader-com-social-write-ups-general-delete-any-video-or-reel-on-facebook-11-250-100965
- Tags: domain:api domain:web3 impact:integrity kind:bounty platform:blog sev:high tech:graphql technique:param-pollution technique:recon vuln:access-control vuln:idor

**Target:** Meta Business Suite GraphQL video crop/reframe endpoint (doc_id 8426940007331645)
**Root cause:** The crop/reframe GraphQL mutation accepted an arbitrary videoID without ownership check, and unexpected aspect_ratio_numerator/denominator values caused the reframing library to produce a broken, unloadable video.
**Steps:**
1. Victim uploads a video to their Facebook profile.
2. Attacker obtains their own Facebook Android app access token.
3. Send GraphQL POST with `doc_id=8426940007331645`, `videoID` set to victim's video, and `reframeAspectRatios` with `aspect_ratio_numerator=1`, `aspect_ratio_denominator=11`.
4. Wait ~5 minutes; the victim's video becomes broken/deleted.
**How found:** While testing Meta Business Suite Reel upload, noticed crop/trim options and hypothesized trimming/cropping others' videos could corrupt them; trim and 1x1 crop failed initially, but re-testing the crop request the next day (suspecting daily updates) caused a test-account video to vanish after ~5 minutes, pointing to the crop parameters.
**Exploitation:** Attacker uses their own access token against the crop mutation, substituting the victim's videoID and malformed aspect ratio values; the backend reframes the victim's video into an unloadable state, effectively deleting it from the profile.
**Insight:** Destructive impact can hide behind benign-looking media-editing mutations: fuzz numeric aspect-ratio/geometry parameters with foreign object IDs and allow for delayed async processing before concluding a feature is safe.