4 ms·
I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire.
by bl4k 16y ago
I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire.
Reminds me of the MySpace worm that took the site down
Time to change your passwords!
(Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie. $() to grab an element), url shorteners and ability to include external JS mean that you can do almost anything in the 140 char payload.
Explainer:
The vulnerability is because URL's are not being escaped properly. For eg. the following URL is posted to Twitter:
http://thisisatest.com/@"onmouseover="alert('test xss')"/
Twitter treats this as the URL. When it is parsed Twitter wraps a link around that code, so the HTML now looks like:
<a href="http://thisisatest.com/@"onmouseover="alert('test xss')"rel/" target="_blank" ="">http://thisisatest.com/@"onmouseover="alert('test xss')"/</a></span>
You can see that by putting in the URL and the trailing slash, Twitter thinks it has a valid URL even though it contains a quote mark in it which allows it to escape the URL attribute and include a mouse over. You can write anything to the page, including closing the link and including a script element.
You don't have to use onmouseover. You could close the link and then insert some external javascript that can re-write your tweet to make it look innocent (or hide that entire tweet), then attach a mousemove event to the body document. This means you could propagate a worm silently and without requiring a mouseover on the actual tweet.
(edit: pretty concerned about the number of people here who think that being able to inject javascript on a site in the context of a users session is not a big deal)
- paraschopra 16y agoSo, you are publicly saying that you are currently trying to hack Twitter by making a worm? :)
- nakkiel 16y agoWho here didn't, at least for fun, try to make his own version of the Javascript bit? I'd like to have a variant of the full black Quine that randomizes the color used. It would be so shiny and Twitter wouldn't prevent it from reposting. Here be Rainbows!
- deleted 16y ago[deleted]
- rakkhi 16y agoMan I just got exploited by this, shutting down use of twitter.com till it is fixed.
- theycallmemorty 16y agoIs this a twitter-only problem with the way the URLs are formed? Or is this a common way of injecting JS into links on other sites as well?
- jasondavies 16y agoIt's caused by Twitter's insufficient escaping of URLs, specifically a rogue quotation mark character can be injected after the @ symbol and thus you end up with something like <a href="URL@" onmouseover="insert XSS attack here">...</a> So this attack won't work on other sites that escape URLs properly.
- moeffju 16y agoIt is made a little harder since you cannot use # or @ in the tweet, and your exploit code is limited to ~130 characters, but if you use $.getScript(), oh boy...
- jasondavies 16y agoIs it really necessary to change one's password? I've logged out and logged in again to make sure I invalidated my old session cookie. Hopefully that's sufficient.
- kwamenum86 16y agoDepends on whether Twitter stores plain text passwords and allows sign in users to see them. Also, it is more importanttto revoke oauth tokens than change passwords because last time I checked the oauth tokens are still valid even if You change your password.
- Tichy 16y agoWhat is the significance of the "@"? Is it because once they encounter the @, they split into a different parsing routine (for example to link @replies)?
- js2 16y agoIf you look at the regex they were using, once it sees an @, it then scans forward until it encounters a /, which is what let's you sneak in anything after the @ other than a /.