Twitter XSS flaw could allow hackers to take over

published 27 August 2009

Twitter is vulnerable to a cross-site scripting flaw that could allow hackers to take control of accounts and steal information.

UK-based search engine optimisation (SEO) expert David Naylor found a bug that could allow anybody to change nofollow links produced by its Application Programming Interface (API).

Naylor said it could allow somebody with technical expertise to create a Twitter application and send malicious tweets with it.

He said that if another Twitter user as much as just saw one of these tweets and they were logged in, their account could be taken over.

Naylor outlined a number of worst-case scenarios, such as the running of code inside a user's browser, redirection to malicious websites, deletion of tweets, mass spam messaging, or the sending of login details to others who might want them.

Twitter was said to have fixed the problem, but in a later blog post Naylor claimed that Twitter "missed the point", and that the vulnerability was still open.

In May, security researcher Aviv Raff warned that even if Twitter's API hired the best security engineer to fix flaws, its API would always be the weakest link.

Twitter has not replied to an IT PRO request to reveal whether or not it has fixed the problem.

Get the ITPro daily newsletter