Published On: 20 Nov 2019
Reposting the story of another's account to own Story Hightlights
Privacy/Authentication
Instagram | Android
---
LOW VALIDDescription
Q: Private or Public Profiles are affected? A: Public. Q: Does the story disappear from Highlights after 24 hours? A: No, it remains. Q: What data can you access? A: Have always access to any public story. Q: How many users are affected? A: All users.
Impact
User can add anyone's public story to his own Highlights on Instagram.
Reproduction Steps
Step
1
Open Instagram and go to your profile.
Step
2
Click (Add +) new Highlight.
Step
3
Select a Story (Your Story)
Step
4
Open Burp Suite
Step
5
Intercept '/api/v1/highlights/create_reel/' POST Request.
Step
6
Edit media_id & media_ids to your target's Story.
Step
7
Issue the request (Even if the server response is 'Oops, an error occurred.' the request was correctly executed) !
Step
8
Check your profile on Instagram.com
OS & Application Version:
Android Version 9 Instagram Version 111.1.0.25.152
