How I was able to see likes and dislikes count even though is hidden by victim | YouTube #4

Steps to reproduce:

Victim:

  1. Upload video. (Shorts)
  2. Edit video.
  3. Show how many viewers like and dislike this video ---> Don't show how many viewers like and dislike this video.
  4. Save.


Attacker:

  1. Open the victim video: https://www.youtube.com/shorts/victim_video_id or https://m.youtube.com/shorts/victim_video_id

  2. like this video along with ... other people
    dislike this video along with ... other people


Will show the YouTube Shorts video likes and dislikes count even though is hidden by the victim.


PoC video: https://youtu.be/CKlDC32adKs


Timeline:

mm/dd/yyyy

10/26/2021 - Bug Found
10/26/2021 - Submit Report
10/26/2021 - Triaged
      Status: New - Assigned
      Priority: P4 - P2
11/04/2021 - 🎉 Nice catch!
      Status: Assigned - Accepted
      Severity: S4 - S2
      Type: Customer Issue - Bug
11/12/2021 - Bounty awarded by Google. ($XXX)
04/15/2022 - Fixed
      Status: Accepted - Fixed

LinkedIn: Alessandro Rumampuk
YouTube: R,ando
Facebook: Ando
Twitter: R ando

Comments