Unremovable Tags In Facebook Page Reviews

Max Pasqua
Dec 14, 2018 · 1 min read

Facebook pages have a feature to leave reviews on them. When making a review a malicious user could tag a victim and it would render the tag unremovable. Upon trying to remove it would give the victim an error. The impact behind this is that the victim is permanently stuck tagged. Attackers could leverage this with massive spam posts or embarrassing information against the victim and he will not be able to remove himself from the post.

Proof of Concept

1) Browse to the page that you want the tag to be stuck on (Preferably owned by the attacker so the owner of the page wont remove the post)

2) Create a review and tag the victim

3) The victim will now no longer be able to remove the tag

Video

Timeline

Submitted- October 13th, 2018

Triaged- October 18th, 2018

Bounty Awarded($500)- December 14th, 2018

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store