The replies to that tweet are beautiful. Sometimes you forget that not everyone in the world can recognize a cross-site scripting vulnerability when they see one!
XSS in Tweetdeck (don't view in Tweetdeck...)
11–20 of 26 posts
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#12What's sad is that not even wrong security was in place here. They didn't even try. There was NO XSS prevention. javascript is the first payload you try when looking for the stupidest XSS you can find....
Has to do with the emoji support, I'm pretty sure.
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#13I guess the New York Times uses Tweetdeck[1].
I saw this because several people I follow had retweeted it and the Twitter app notifies you if several of your followers do the same thing. It's a useful feature. If Tweetdeck does the same thing it could make this spread really fast.
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#14So apparently this was retweeted by @5SOS, a teen pop band with some 3 million followers, which is why most of the responses are confused teenagers. For some reason this is hilarious to me. Not the pinnacle of responsible disclosure, but no real harm done.
Obviously their social media agent uses tweetdeck...
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#15Wonder if it's because of the emoji at the end? It's HEAVY BLACK HEART, U+2764, e29da4 in hex.
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#16What's sad is that not even wrong security was in place here. They didn't even try. There was NO XSS prevention. javascript is the first payload you try when looking for the stupidest XSS you can find....
Apparently it was only activated if you included an emoticon (<3) in your tweet, possibly following the closing script tag.
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#17Looks like it might even be starting to loop around?
The Guardian have already scurried an article about it [1].
[1] http://www.theguardian.com/technology/2014/jun/11/twitter-tw...
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#18I wonder if the poster of this "twitter worm" could get in legal trouble for this; it's quite similar to the Samy MySpace worm[1] of a decade ago, where the creator was charged with a felony (they plea bargained out).
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#19Tweetdeck seems to be down now.
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#20What's sad is that not even wrong security was in place here. They didn't even try. There was NO XSS prevention. javascript is the first payload you try when looking for the stupidest XSS you can find....
Apparently it was only activated if you included an emoticon (<3) in your tweet, possibly following the closing script tag.
Any UTF8 char actually 💩