HexBrain

X / xAI · Report #921286

Denial of Service [Chrome]

Validstatus
mediumseverity
$560bounty
66upvotes
24 Jul 2020disclosed

How it was found

Hi Team,

Summary: I encountered such an error while creating a new account: {F903872} But I don't remember where I found this last point. I remember only when I was a new member. I created a url using the load %xx as in #500686 reports as follows. https://twitter.com/i/flow/%00

I got a result like the #903740 report I just sent you: {F903873}

But this time only Chrome works. I haven't figured out why this DoS was triggered yet. I will keep you updated when I find new findings.

Thanks! @cyanpiny

Impact

An attacker could apply this DoS to any Twitter account or popular tag. It prevents a large audience or target user from accessing Twitter from the browser.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original