MoTB #03: TwitWall Persistent XSS

What is TwitWall
"TwitWall is the easy-to-use, quick-to-blast-out, instant blog companion for Twitter. With TwitWall, you can embed your favorite videos and widgets, upload your photos, mp3 music or podcasts, - you name it.." (TwitWall home page)


Twitter affect
TwitWall can be used to send tweets and follow/unfollow other Twitter users.
TwitWall is using OAuth authentication token in order to utilize the Twitter API.


Popularity rate
Though it's here since Summer 2008, it has yet to gain enough user base to get into any of the top twitter services lists - 0.5 twits


Vulnerability: Persistent Cross-Site in TwitWall entry view page.
Status: Patched.
Details: TwitWall allows HTML to be embedded in the wall entries. According to the vendor this was done because "our users with non-malicious intentions enjoy using our html editor". Unfortunately, the entry view page does not santize scripts and events that came along with the HTML.
This vulnerability could have allowed an attacker to send tweets, follow/unfollow others on behalf of its victims.
Screenshots:




Vendor response rate
Vulnerability was fully fixed 20 hours after it has been reported. Excellent - 5 twits.

MoTB #02: Reflected XSS in HootSuite

What is HootSuite
"HootSuite is the ultimate Twitter toolbox. With HootSuite, you can manage multiple Twitter profiles, add multiple editors, pre-schedule tweets, and measure your success. HootSuite lets you manage your entire Twitter experience from one easy-to-use interface." (HootSuite about page)


Twitter affect
HootSuite can be used to send tweets, direct messages and follow/unfollow other Twitter users from multiple Twitter accounts.
HootSuite is using Username/Password authentication in order to utilize the Twitter API.


Popularity rate
27th place in the Top 100 Twitter Services, according to “The Museum of Modern Betas” - 3.5 twits


Vulnerability: Reflected Cross-Site in the “add-acount” page.
Status: Patched.
Details: The HootSuite "add-account" page does not encode HTML entities in the "pageMode"
variable, which can allow the injection of scripts.
This vulnerability could allowed an attacker to send tweets, direct messages and to follow/unfollow others on behalf of its victims.
Proof-of-Concept: http://hootsuite.com/twitter/add-account?height=240&width=280&modal=true&pageMode=xxx%22%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E
Screenshot:



Vendor response rate
Vulnerability was fixed two hours after it has been reported. Excellent - 5 twits.

MoTB #01: Multiple vulnerabilities in bit.ly service

What is bit.ly
"bit.ly allows users to shorten, share, and track links (URLs). Reducing the URL length makes sharing easier. bit.ly can be accessed through our website, bookmarklets and a robust and open API. bit.ly is also integrated into several popular third-party tools such as Tweetdeck." (bit.ly about page)


Twitter affect
bit.ly can be used to send tweets with the shortened URLs through a form on their website, or a simple GET request.
bit.ly is using the OAuth authentication tokens in order to send tweets via the Twitter API.


Popularity rate
Second most popular URL shortening service in the wild - 4.5 twits



Vulnerabilities
1) Reflected Cross-Site Scripting in the “url” query parameter.
Status: Patched.
Details: This vulnerability was first reported by Mario Heiderich on May 18th 2009, on twitter.
A week later, I found that this vulnerability got fixed. Unfortunately, after playing with it a bit, I figured that it was only partially fixed. Instead of encoding the HTML entities, bit.ly developers have decided to strip the <> characters. E.g. this proof-of-concept would have popup an alert on IE7:
htttp://bit.ly/?url="%20style="color:expression(document.body.onload=function()%20{alert(1)})
The following is the screenshot of the PoC:


Several days ago, after a long discussion with Mario, bit.ly has finally fully fixed this vulnerability.

2) Reflected Cross-Site Scripting in the keywords parameter.
Status: Patched.
Details: This vulnerability was reported by Mike Bailey on June 24th 2009. See Mike's advisory for more details: http://skeptikal.org/2009/06/parsing-quirk-causes-bitly-xss.html
This vulnerability was fixed by bit.ly yesterday.

3) Reflected POST Cross-Site Scripting in the username field of the login page
Status: Patched
Details: This vulnerability was reported by Mario Heiderich. See Mario’s advisory for more details: http://heideri.ch/bit.ly.txt
This vulnerability was fixed by bit.ly yesterday.

4) Persistent Cross-Site Scripting in the content-type field of the URL info page
Status: *Unpatched* Patched.
Details: This vulnerability was submitted by Mike Bailey on June 25th 2009.
Whenever a URL of a website gets shortened by bit.ly service, an information page is created for the URL, with statistics and metadata about the website.
One of the metadata information being stored by bit.ly is the content-type response header of the shortened URL page. This information of-course can be easily changed.
bit.ly fails to encode HTML entities while displaying the content-type information, and therefore allows injection of scripts to the page.
Live proof-of-concept can be found here: http://bit.ly/info/JvH83
Screenshot of the PoC (just in case the live demo will be removed):


Vendor response rate
It took bit.ly a month and a half to fix simple XSS vulnerabilities. Very poor - 0.5 twits.


In conclusion
bit.ly has a large user base (who doesn't click bit.ly links?). However, with such a poor response rate to security vulnerabilities, and with such a poorly coded website, in terms of security, we can only hope for the best. Please be careful clicking those shortened URLs...

[Update - 3 hours into Month of Twitter Bugs] bit.ly have finally fixed the last vulnerability.

Month of Twitter Bugs

July 2009 will be Month of Twitter Bugs.
This blog will be used for posting the vulnerabilities.
More details here: http://aviv.raffon.net/2009/06/15/MonthOfTwitterBugs.aspx

Twitter Leak

Gareth Heyes demonstrated on his blog that by exploiting a weakness in JSON, it is possible to extract the twits of the visitor's friends.

Twitter have fixed this issue, by making authentication on the friends timeline mandatory, as is already on other pages with sensitive information.
Giorgio Maone, the creator of NoScript, shows that the JSON weakness can still be demonstrated on the public timeline page. Fortunately, this page is intended for public information.

Malware on Twitter

Well, it seems like it didn't take that long for the malware authors to notice the opportunity in abusing Twitter as a malware distribution platform.
According to Kaspersky Labs:
"...This profile has obviously been created especially for infecting users, as there is no other data except the photo, which contains the link to the video.

If you click on the link, you get a window that shows the progress of an automatic download of a so-called new version of Adobe Flash which is supposedly required to watch the video. You end up with a file labeled Adobe Flash (it’s a fake) on your machine; a technique that is currently very popular..."




Unfortunately, the auto-follow-me vulnerability is still exploitable for Internet Explorer users. I'm still withholding the technical details of this vulnerability in a hope that it won't be exploited in the wild, more than it was probably already did.

Coming up: Auto-follow-me vulnerabilty

Twitter suffers from a vulnerability which allows an attacker to force his victim to follow him automatically.

Twitter security team was notified on 31-July-2008.
Twitter partially fixed this vulnerability on 01-Aug-2008. The vulnerability can still be exploited on Internet Explorer. Users of other browsers are safe.
Twitter delivered a fix for IE on 04-Aug-2008. Fixed was verified on 11-Aug-2008(sorry, BlackHat/Defcon duties).

Technical details will be added soon...