How I lost my followers on Medium
Tags: Followers, Technology, Hacking, Cybersecurity, Bug Bounty

How I lost my followers on Medium

A bug bounty report

I was writing a new article on Medium when I started procrastinating and looking at the traffic this website is producing. Knowing there is a bug bounty program on Medium that I was awarded before, I thought maybe I am lucky once again and decided to play around with the following and unfollowing calls.

The GraphQL API

Medium uses GraphQL, initially developed by Facebook, to communicate with parts of their API and inform the database about follow and unfollow requests. To do so, only the target user-id is required, user authentication is verified via auth cookies. As answer a request, the server would reply with a JSON object as a result, including the key “isFollowing” either set to true or false. Below we see the two requests and responses:

Request:

POST /_/graphql HTTP/1.1

{

"operationName":"followUser",

"variables":{"targetUserId":"abc123"},

"query":"mutation followUser($targetUserId: ID!) {

followUser(targetUserId: $targetUserId) {

id

isFollowing

__typename

}

}

"

} Response:

HTTP/1.1 200 OK

{

"data":{

"followUser":{

"id":"abc123",

"isFollowing":true,

"__typename":"User"

}

}

} Request:

POST /_/graphql HTTP/1.1

{

"operationName":"unfollowUser",

"variables":{"targetUserId":"abc123"},

"query":"mutation unfollowUser($targetUserId: ID!) {

unfollowUser(targetUserId: $targetUserId) {

id

isFollowing

__typename

}

}

"

} Response:

HTTP/1.1 200 OK

{

"data":{

"unfollowUser":{

"id":"abc123",

"isFollowing":false,

"__typename":"User"

}

}

}

The bug

Part of my standard procedure is to repeat API calls made and see what happens. I did the same with the aforementioned operations and tried it on my test account. Unfortunately, increasing my follower numbers by resending the “followUser” operation did not work, however, I was lucky with “unfollowUser”. I could resend this command and the follower number of my other account would decrease every time, even without me following the other account. On the other side, it also affected the number of accounts that I follow on my profile. The example below shows this procedure. It first shows the follower number of Mrx and the following number of FHantke. After resending the packet in the DevTools, both numbers change accordingly.

Demo of the bug (click on it to zoom)

Impact

Giving this bug, what is the impact here? I checked whether real followers were affected, yet all my followers stayed the same, only the number displayed in my profile changed. This means a malicious user could manipulate the number shown in one's profile, even to a negative number, nevertheless, it would not result in any critical issues, such as real follower loss. Still, false follower numbers can be misleading and such API behavior has to be reported.

Reporting

I found the bug on the 01.07.2020 and submitted it the same evening. 08.07.2020 I heard back by them confirming the bug and telling me they look into it. Two days later, on the 10th, I was notified that the bug is fixed and I was awarded a nice little bounty.

Thank you again Medium, it’s always good to have a excellent working Bug Bounty Program!