“Th vulnerability is located in the comment id and legacy id of the comments function. Remote attackers with low privileged user accounts are able to delete postings of other users without auth. The attacker can intercept the session and exchanged the comment and legacy id to delete or add for example comments.” states the advisory.
This bug allowed a malicious user to delete any comment on Facebook .
Login to your facebook account
Put a comment anywhere to a random post
Remove your comment by usage of the standard function in facebook
Capture the headers information on requesting to delete
Go to the victim account (any account not friend or there friends) because the issue works to both
Like his comment and capture the request by intercepting the values
Change your comment id with the victim comment id that you and change the legacy id
Replay the tampered request with the manipulated values
Now the comment will be unauthorized removed
Successful reproduce of the security vulnerability that allows to delete any comment of other users.
Thanks for [securityaffairs] https://securityaffairs.co/wordpress/33813/hacking/facebook-comment-on-facebook.html