HexBrain
Open on HackerOneSign in

X / xAI · Report #53098

XSS in twitter.com/safety/unsafe_link_warning

Validstatus
$1,400bounty
4upvotes
3 Apr 2015disclosed

How it was found

The following page has XSS. https://twitter.com/safety/unsafe_link_warning?unsafe_link=[vulnerable_param]

Steps to reproduce:

  1. Go to the following URL using IE: https://twitter.com/safety/unsafe_link_warning?unsafe_link=https%3A%2F%2Ftwitter.com%2Fsafety%2Funsafe_link_warning%3Funsafe_link%3Dhttp%3A%2F%2Fexample.com%2520onmouseover%3Dalert%281%29%2520style=font-size:100pt%2520

  2. Click "continue".

  3. Do mouseover to "continue". XSS occurs.

FYI in Firefox and Chrome, it is blocked by CSP :)

I recommend fixing this. Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original