XSS in Tweetdeck (don't view in Tweetdeck...)

maaarghk wrote: post #3

hybridknight wrote: post #2

so fast

Apparently it's fixed already http://thenextweb.com/twitter/2014/06/11/tweetdeck-users-xss...

Definitely not fixed here. Chrome on Linux, logged out and back in, closed and re-opened tab. Not fixed.

Re: XSS in Tweetdeck (don't view in Tweetdeck...)

#6

Post by basicallydan » Wed, Jun 11, 2014, 4:48 PM UTC

39,000 retweets and counting.

Re: XSS in Tweetdeck (don't view in Tweetdeck...)

#7

Post by maaarghk » Wed, Jun 11, 2014, 4:49 PM UTC

6thSigma wrote: post #4

A lot of people I follow must use Tweetdeck. This has been retweeted on my feed several times in the last few minutes.

Somebody in my office got hit with it, that's how I found out.

Re: XSS in Tweetdeck (don't view in Tweetdeck...)

#8

Post by theboss » Wed, Jun 11, 2014, 4:50 PM UTC

What's sad is that not even wrong security was in place here. They didn't even try. There was NO XSS prevention.

javascript is the first payload you try when looking for the stupidest XSS you can find....

Re: XSS in Tweetdeck (don't view in Tweetdeck...)

#9

Post by adambard » Wed, Jun 11, 2014, 4:51 PM UTC

So apparently this was retweeted by @5SOS, a teen pop band with some 3 million followers, which is why most of the responses are confused teenagers.

For some reason this is hilarious to me. Not the pinnacle of responsible disclosure, but no real harm done.

Re: XSS in Tweetdeck (don't view in Tweetdeck...)

#10

Post by tarekmoz » Wed, Jun 11, 2014, 4:52 PM UTC

Security 101 ?